GStreamer gst-plugins-good contains an unbounded memory growth vulnerability in the rtph264depay and rtph265depay RTP depayloaders. In gstrtph264depay.c, the FU-A/FU-B fragmentation handler (case 28/29 in gstrtph264depayprocess()) accumulates incoming RTP fragment payloads into a GstAdapter via gstadapterpush() without enforcing any maximum reassembly size. The adapter is only flushed when the E (end) bit is set in the FU header, which triggers gstrtph264finishfragmentationunit(). If an attacker sends a start fragment (S=1, E=0) followed by an unlimited stream of continuation fragments (S=0, E=0) with sequential RTP sequence numbers, the adapter grows without bound until process memory is exhausted. The same flaw exists in gstrtph265depay.c in the FU handler (case 49 in gstrtph265depayprocess()). The GStreamer security team confirmed the vulnerability and that rtph265depay is also affected. A fix is pending in private security Merge Request 113, planned for release in GStreamer 1.28.6 or 1.28.7. Confirmed on GStreamer 1.28.2 and 1.28.5 (dynamic testing). Reported by Yehia Ali Mohamed Ezzat (yehiaezzat710). PSIRT Ticket: PSIRTSUPT-20847.