The vulnerability in GNU Gatekeeper (gnugk) permits an out‑of‑bounds read when parsing RTCP SDES items that lack a terminating NUL byte. An attacker can remotely craft such RTCP packets and send them to the media proxy port during proxied H.323 calls with EnableRTCPStats turned on, causing the gatekeeper to crash. The issue does not allow code execution or data disclosure, but it can disable the gatekeeper service, disrupting voice, video, and media relay functionality for all connected users.

All installations of GNU Gatekeeper before version 5.16 are affected. The problem was identified in the 5.15 release and earlier; the 5.16 release contains the upstream fix. Users running v5.15 or older, or any build derived from it, remain vulnerable. The issue is present in the mainline gnugk code base maintained by the willamowius organization.

The vulnerability has a CVSS score of 6.3, indicating moderate severity. EPSS data is not available, and the problem is not currently listed in the CISA KEV catalog. Exploitation requires an attacker’s ability to send crafted RTCP SDES packets to the gatekeeper’s media proxy port, which is typically exposed on the network. The flaw is an out-of-bounds read that triggers a crash, resulting in a denial-of-service condition rather than data compromise. Given the remote network surface and the ease of crafting malformed packets, the risk of exploitation remains non-negligible for exposed deployments.