A use‑after‑free flaw in GStreamer’s rtpsbcdepay module lets a remote attacker execute arbitrary code with the privileges of the process that loads the library. When RTP payloads are processed, the code fails to check that an object still exists before acting on it, allowing a crafted packet to free the object and then reuse the dangling pointer. The result is the ability to run attacker supplied code in the application’s context.

Any installation that includes the rtpsbcdepay plugin is potentially vulnerable. The advisory does not list specific fixed versions, so any GStreamer build that uses the plugin must be examined and updated to the latest release that contains the patch. Because no version constraints are given, the risk applies broadly across deployments.

The CVSS score of 8.8 indicates high severity. The EPSS score is reported as less than 1%, meaning exploitation is unlikely but not impossible. The vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is the delivery of a malicious RTP payload over a network connection that exposes rtpsbcdepay to untrusted traffic, which can trigger the use‑after‑free condition and allow code execution.