Executive brief
A logic error exists in GStreamer, a popular multimedia framework used for handling audio and video streams. The software incorrectly validates security certificates during the setup of WebRTC connections, which are commonly used for real-time video conferencing and communication. If an attacker can intercept the initial connection setup, they could potentially bypass security checks intended to prevent eavesdropping or tampering with the media stream.
Technical details
A logic vulnerability exists in GStreamer's webrtcbin component (within gst-plugins-bad) due to an inverted boolean condition in the _check_sdp_crypto() function in webrtcsdp.c. The code incorrectly rejects Session Description Protocol (SDP) offers that contain the required 'a=fingerprint' attribute while accepting those that lack it. An attacker capable of performing a man-in-the-middle (MITM) attack on the signaling channel can exploit this to bypass DTLS certificate fingerprint binding. While the signaling channel is typically protected by TLS, this flaw represents a defense-in-depth failure that weakens protections against media stream interception. A fix is planned for GStreamer version 1.28.5.
Affected products
- Red Hat gstreamer1-plugins-bad-free 1.28.3, 1.28.4
- GStreamer GStreamer gst-plugins-bad 1.28.3, 1.28.4
Timeline
- 2026-07-07: disclosed: Vulnerability reported and CVE assigned
- 2026-07-07: advisory: Red Hat published security advisory details
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-14935
- https://bugzilla.redhat.com/show_bug.cgi?id=2497679
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5171