CVE-2026-18299
Received Received - Intake

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18299
EUVD
EUVD-2026-63448

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gstreamer rtpsbcdepay *
gstreamer gstreamer to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Use-After-Free Remote Code Execution vulnerability in GStreamer's rtpsbcdepay component. It occurs when processing RTP payload elements without validating object existence first. Attackers can exploit this to execute arbitrary code in the context of the current process.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of GStreamer. Use commands like 'gst-inspect-1.0 rtpsbcdepay' to verify the plugin version. Compare installed versions against the patched release from GStreamer.

Impact Analysis

If you use GStreamer in your system, an attacker could remotely execute malicious code on your device. This could lead to unauthorized access, data theft, or system compromise depending on the application's privileges.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR or HIPAA if personal or health data is compromised.

Mitigation Strategies

Immediately update GStreamer to the latest patched version provided by the vendor. If updating is not possible, disable the rtpsbcdepay plugin or restrict network access to systems using GStreamer until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18299. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart