CVE-2026-18649: Unbounded Memory Growth
GStreamer RTP Depayloader
A remote, unauthenticated denial of service in GStreamer's H.264 and H.265 RTP depayloaders, where FU-A fragment reassembly had no size limit. Assigned CVE-2026-18649.
Overview
The rtph264depay and rtph265depay elements reassemble fragmented video (FU-A fragments) into a GstAdapter with no upper bound on the buffered size. A remote host can send one start fragment and then a stream of continuation fragments that never sets the end bit, so the reassembly never completes and the buffer grows for the lifetime of the stream. The process eventually runs out of memory and dies.
It needs no authentication and no malformed packets. Any pipeline that runs one of these depayloaders on network data is exposed: RTSP camera clients, media servers, WebRTC endpoints, and NVRs.
- Class: CWE-770, Allocation of Resources Without Limits
- CVSS 3.1: 7.5 (High), AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Affected:
rtph264depayandrtph265depaybefore GStreamer 1.28.6
Fixed in GStreamer 1.28.6. Both depayloaders gained a max-fragmentation-unit-size property that caps FU-A reassembly, defaulting to 32 MB.
Write-ups
I wrote two posts about this one. A technical breakdown of the bug covering the code path, the proof of concept, and the fix, and a longer story about how I found it, including the seven attempts that failed first.