Blog
Research notes, technical writing, and security posts.
13 min read
Four Hours, Four Bytes: Hunting Down CVE-2026-18649
The full story of finding an unbounded memory growth bug in GStreamer's RTP depayloader, including the seven attempts that failed before the exploit worked.
gstreamer rtp dos vulnerability-research cve
9 min read
CVE-2026-18649: Unbounded Memory Growth in GStreamer's RTP Depayloaders
A technical breakdown of a remote, unauthenticated denial of service in GStreamer's H.264 and H.265 RTP depayloaders, where FU-A fragment reassembly had no size limit.
gstreamer rtp dos memory-safety cve