Integer Conversion Error in GStreamer H.264 RTP Depayloader Affects Remote Systems

CVE-2026-119610

What is CVE-2026-119610?

A vulnerability exists in GStreamer's H.264 RTP depayloader component, where processing certain multi-time aggregation RTP packets leads to a signed/unsigned integer conversion error. This flaw can result in an underflow of the remaining-length counter, causing it to jump to a large positive value when a packet is truncated. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted RTP packet, potentially leading to an out-of-bounds heap read of up to approximately 64 KiB of process memory. This disruption may crash the GStreamer pipeline, leading to a denial of service, and may also expose adjacent heap data in relay or transcoding environments.

References