CVE-2026-18299: GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing

CVE-2026-18299 · Severity: high · CVSS 7.8 · Published 2026-08-20

GStreamer is a multimedia library used by applications to process audio and video streams. A vulnerability in the RTP SBC (Bluetooth audio codec) component allows an attacker to send a specially crafted network packet that causes the application to crash or potentially execute arbitrary code, disrupting media playback and potentially compromising the affected system.

Technologies: Gstreamer. Vendors: Gstreamer.

Quick answers

Is CVE-2026-18299 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18299 being exploited in the wild.
How severe is CVE-2026-18299?
High severity, with a CVSS score of 7.8, published 20 August 2026.
Which products and versions are affected?
GStreamer gst-plugins-good < 1.28.5.
Is there a fix for CVE-2026-18299?
A patch was published on 2026-07-08: GStreamer 1.28.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18299 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-18299?
Check whether you run Gstreamer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The rtpsbcdepay element in gst-plugins-good fails to validate the size of incoming RTP payload data before parsing the SBC-specific payload header, resulting in an out-of-bounds read. Additionally, the element does not check whether the reassembly adapter contains data before extracting a buffer and fails to reset buffer variables to NULL after transferring ownership, leading to use-after-free of a GstBuffer object. The vulnerability is triggered by sending a crafted RTP packet with minimal or no payload data to a network-reachable application—no authentication or user interaction is required. In standard builds with assertions enabled, the impact is limited to denial of service via critical warnings or crash; in builds with assertions disabled, use-after-free occurs but practical impact remains DoS-focused since freed memory is read at fixed offsets rather than affecting control flow. GStreamer 1.28.5 addresses the issue.

Affected products

  • GStreamer gst-plugins-good < 1.28.5

Timeline

  • 2026-05-21: disclosed: Vulnerability reported to vendor
  • 2026-07-08: patched: GStreamer 1.28.5 released with fix
  • 2026-07-29: advisory: ZDI-CAN-29787 and CVE-2026-18299 publicly disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.