Description
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
Published: 2026-10-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A heap‑based buffer overflow occurs in the GStreamer rtpL16depay element when it copies user supplied data without checking the length of the RTP payload. The flaw allows a remote attacker to trigger arbitrary code execution in the context of the current process, making it a classic overflow weakness.

Affected Systems

Every installation of the GStreamer multimedia framework that uses the rtpL16depay element is affected. It is inferred that because no specific version ranges are listed, any instance that processes RTP payloads via this element should be treated as vulnerable.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. An EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, but the lack of validation means the flaw could be triggered by a crafted RTP packet over the network. Based on the description, it is inferred that this scenario is plausible, making the vulnerability likely exploitable. The high severity and remote nature warrant a high priority response.

Generated by OpenCVE AI on October 22, 2026 at 02:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest GStreamer update that contains the patch for the rtpL16depay buffer overflow.
  • If the RTP payload is not required for your use case, remove or disable the rtpL16depay element from the pipeline to eliminate the attack surface.
  • Restrict network traffic that could supply malicious RTP streams, for example by using firewall rules or by processing streams only from trusted sources.

Generated by OpenCVE AI on October 22, 2026 at 02:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Gstreamer
Gstreamer gstreamer
Vendors & Products Gstreamer
Gstreamer gstreamer

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
Title GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
Weaknesses CWE-122
References
Metrics cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Gstreamer Gstreamer
cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2026-10-23T11:06:23.382Z

Reserved: 2026-10-15T17:43:26.712Z

Link: CVE-2026-111183

cve-icon Vulnrichment

Updated: 2026-10-23T11:01:18.072Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T18:17:23.477

Modified: 2026-10-23T12:18:08.327

Link: CVE-2026-111183

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:00:05Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow