CVE-2026-125712: Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
Other sources
GStreamer-SA-2026-0030: Missing bounds checks while parsing RTCP SDES items and entries allow reads past the packet buffer. The packet length calculation also underestimates the total size by four bytes, weakening existing checks. A crafted RTCP packet may cause a crash, denial of service, or information disclosure. Fixed in gst-plugins-base 1.28.4.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-baseto a version that resolves this vulnerability.Fixed in 1.28.4Patch GStreamer-SA-2026-0030
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the affected RTCP SDES parser are exposed when they have an active media session that a remote sender can reach. The attack can be performed over the network without authentication or user interaction.
What must an attacker send to trigger the flaw?
The attacker must send a malformed RTCP SDES entry whose declared length is larger than the received packet. This can make the receiver read beyond the packet buffer.
What is the likely impact of successful exploitation?
Successful exploitation can crash the receiving application, creating a denial-of-service condition. It may also expose a limited amount of process memory.