CVE-2026-125712
Awaiting Analysis Awaiting Analysis - Queue

GStreamer RTCP SDES Packet Parser Buffer Overflow

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: redhat-SADP

Description
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125712
EUVD
EUVD-2026-120881

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in GStreamer's gst-plugins-base library affecting RTCP SDES packet parsing. A remote attacker can send a malformed SDES entry with a declared length exceeding the actual packet size. The parser fails to validate these bounds, causing it to read beyond the packet buffer. This may crash the application or expose limited process memory.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption in applications using GStreamer's gst-plugins-base library. Check if your system runs affected versions (prior to 1.28.4) by inspecting installed packages. Use network traffic analysis tools like Wireshark to capture and inspect RTCP packets for malformed SDES entries.

Impact Analysis

This flaw could allow an attacker to crash applications processing RTCP packets, leading to denial of service. In rare cases, it might expose small amounts of process memory. Systems using vulnerable GStreamer versions prior to 1.28.4 are at risk if exposed to untrusted RTCP traffic.

Mitigation Strategies

Immediately update gst-plugins-base to version 1.28.4 or later. If updating is not possible, disable RTP session handling if RTP/RTCP is unnecessary. Restrict RTCP ports to trusted peers as a temporary measure. Avoid processing untrusted RTCP packets until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...