UBUNTU-CVE-2026-119610: Medium severity ubuntu/gst-plugins-good1.0 vulnerability
A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that receive and process H.264 RTP streams using the GStreamer H.264 RTP depayloader are exposed. Relay or transcoding deployments have additional potential impact if their output is accessible to the attacker, because adjacent heap contents may be exposed.
What does an attacker need to exploit the flaw?
An attacker needs to be able to send a malformed, truncated MTAP16 or MTAP24 H.264 RTP packet to the receiving GStreamer pipeline. No authentication is required.
Is exploitation limited to denial of service?
A malformed packet can crash the receiving pipeline through an out-of-bounds heap read. In relay or transcoding scenarios where the attacker can access output, the read may also expose adjacent heap memory, up to approximately 64 KiB.