CVE-2026-119610: Red Hat Enterprise Linux (high)

Summary

The GStreamer good-plugins package, specifically its H.264 RTP depayloader, can be attacked remotely without logging in. A single malformed MTAP16 or MTAP24 RTP packet can trigger an out-of-bounds heap read that may crash the receiving pipeline or, in relay or transcoding setups where output is reachable by the attacker, expose nearby heap memory.

Read the original description

A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.

cve.now Index

35Pcve.now Index 35 of 100 · methodology v3 · provisional

Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
Exposure17/25No login or user action needed, reachable over the network without a login · Unknown: Advisories don't say whether default setups are affected
Reach10/20Shipped in major Linux distributions
Severity8.2/10CVSS 8.2
No patch0/5No signal

What would change the score

Would score about 80 if added to CISA KEV
Would score about 75 if CISA's SSVC rates exploitation active
Would score about 40 if advisories confirm default setups are exposed

How the score works · Rankings

What to do

Upgrade to a fixed version: 1.28.9.
Workaround: Block untrusted H.264 RTP streams at the network perimeter (firewall or UDP ingress filter) to prevent malformed packets from reaching GStreamer pipelines. Alternatively, disable or avoid deploying the rtph264depay GStreamer element when processing RTP from untrusted sources.

Timeline

Nov 9, 2026, 1:00 PM UTCCVE published
Nov 9, 2026, 1:15 PM UTCFirst seen by cve.now

Affected versions

gstreamer1-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported

Evidence 4

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-119610

Is CVE-2026-119610 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

What does this mean?

A malformed MTAP16 or MTAP24 multi-time aggregation packet makes the H.264 RTP depayloader read past the end of a heap buffer. The read can cover up to about 64 KiB of process memory, which can crash the GStreamer pipeline.Source: bugzilla.redhat.com, access.redhat.com

Am I affected, and how do I check?

The advisory lists gst-plugins-good 1.28.0 through 1.28.8 as affected, on pipelines that auto-plug the rtph264depay element while processing MTAP16 or MTAP24 packets. To check, run gst-inspect-1.0 --version to see the installed GStreamer version, and check whether a pipeline uses rtph264depay.Source: bugzilla.redhat.com, access.redhat.com

How do I fix CVE-2026-119610?

Upgrade gst-plugins-good to 1.28.9, which contains the fix. That release was not yet published as of the facts' date, so check your distribution's packages for a build that includes the fix.Source: bugzilla.redhat.com, access.redhat.com

Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned…