GStreamer Remote Code Execution Vulnerability in RTP Payload Processing
CVE-2026-18299

7.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
20 August 2026

What is CVE-2026-18299?

The GStreamer framework is exposed to a vulnerability that can be exploited to execute arbitrary code remotely. This arises from improper validation within the RTP payload element processing, allowing an attacker to manipulate the existence of an object before it is used. Successful exploitation of this flaw could lead to remote code execution within the context of the affected system, enabling potential compromise of security and integrity. It’s essential to monitor this vulnerability and apply necessary patches as released by GStreamer to mitigate associated risks.

Affected Version(s)

GStreamer 99fde1184fe8b12d0721230941c1bf2080913183

References

https://www.zerodayinitiative.com/advisories/ZDI-26-467/
x_research-advisory
https://gstreamer.freedesktop.org/security/sa-2026-0051.html
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.