Out-of-Bounds Read Vulnerability in GNU Gatekeeper by Willamowius
CVE-2026-121626

6.3MEDIUM

Key Information:

Vendor

Willamowius

Status
Gnugk
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121626?

GNU Gatekeeper versions prior to 5.16 are susceptible to an out-of-bounds read vulnerability stemming from improper handling of short probe packets. When attackers send a specially crafted RTCP packet to the media port during H.460.24 probing, they can exploit this flaw to read beyond the allocated heap memory, potentially leading to crashes. This vulnerability emphasizes the necessity of keeping software updated to mitigate risks associated with heap-related flaws.

Affected Version(s)

gnugk 0 < 5.16

References

https://github.com/willamowius/gnugk/commit/160aa27344ecc...
patch
https://github.com/willamowius/gnugk/releases/tag/v5_16
release-notes
https://github.com/willamowius/gnugk/blob/v5_15/GkClient....
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Jan Willamowius
.