Is CVE-2026-119610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119610 being exploited in the wild.

How severe is CVE-2026-119610?

High severity, with a CVSS score of 8.2, published 9 November 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Good 1.28.0 and later.

How is CVE-2026-119610 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119610?

Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119610: GStreamer gst-plugins-good H.264 RTP depayloader heap read overflow

CVE-2026-119610 · Severity: high · CVSS 8.2 · Published 2026-11-09

GStreamer is a multimedia framework used to build applications that handle audio and video streaming. A flaw in the H.264 RTP depayloader element allows a remote attacker to send a malformed network packet that crashes the pipeline or leaks up to 64 KiB of process memory. This can cause service outages in video streaming or transcoding applications, and potentially expose sensitive data in deployments where the output is accessible to attackers.

Technologies: Gstreamer Gst-Plugins-Good. Vendors: Gstreamer.

Quick answers

Is CVE-2026-119610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119610 being exploited in the wild.
How severe is CVE-2026-119610?: High severity, with a CVSS score of 8.2, published 9 November 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Good 1.28.0 and later.
Is there a fix for CVE-2026-119610?: No fixed version is recorded yet. Block untrusted H.264 RTP streams at the network perimeter using a firewall or UDP ingress filter. Alternatively, disable or avoid deploying the rtph264depay GStreamer element when processing RTP from untrusted sources. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119610 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119610?: Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Block untrusted H.264 RTP streams at the network perimeter using a firewall or UDP ingress filter. Alternatively, disable or avoid deploying the rtph264depay GStreamer element when processing RTP from untrusted sources.

Technical details

The vulnerability is an out-of-bounds heap read caused by a signed/unsigned integer underflow in the MTAP16/MTAP24 RTP packet processing code path. A remote, unauthenticated attacker can trigger this via a single malformed H.264 RTP packet sent over the network to any pipeline that auto-plugs the rtph264depay element. Exploitation results in denial of service (crash) and potential memory disclosure of adjacent heap contents, especially in relay or transcoding scenarios.

Affected products

GStreamer gst-plugins-good 1.28.0 and later

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.