The GStreamer gst-plugins-good package contains rtph264depay and rtph265depay RTP depayloader elements that do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end‑of‑fragment marker. The reassembly buffer grows without bound until the process memory is exhausted, causing the process to terminate and resulting in a denial of service. This weakness is classified as CWE‑770 (Uncontrolled Memory Allocation).

The vulnerability affects Red Hat Enterprise Linux 10, 7, 8 and 9 through the gst‑plugins‑good package. Any installation of these RHEL versions that includes the GStreamer framework is potentially impacted.

The CVSS score of 7.5 indicates high risk. EPSS is not available, so the exact likelihood of exploitation is unknown, but the vulnerability can be triggered remotely over the network by sending crafted RTP streams, and no authentication is required. The CVE is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation in the wild. Nonetheless, the attack vector is plausible and the impact complete denial of service to the GStreamer process.