Executive brief
GStreamer is a multimedia library used by applications to process audio and video streams. A vulnerability in the RTP SBC (Bluetooth audio codec) component allows an attacker to send a specially crafted network packet that causes the application to crash or potentially execute arbitrary code, disrupting media playback and potentially compromising the affected system.
Technical details
The rtpsbcdepay element in gst-plugins-good fails to validate the size of incoming RTP payload data before parsing the SBC-specific payload header, resulting in an out-of-bounds read. Additionally, the element does not check whether the reassembly adapter contains data before extracting a buffer and fails to reset buffer variables to NULL after transferring ownership, leading to use-after-free of a GstBuffer object. The vulnerability is triggered by sending a crafted RTP packet with minimal or no payload data to a network-reachable application—no authentication or user interaction is required. In standard builds with assertions enabled, the impact is limited to denial of service via critical warnings or crash; in builds with assertions disabled, use-after-free occurs but practical impact remains DoS-focused since freed memory is read at fixed offsets rather than affecting control flow. GStreamer 1.28.5 addresses the issue.
Affected products
- GStreamer gst-plugins-good < 1.28.5
Timeline
- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-07-08: patched: GStreamer 1.28.5 released with fix
- 2026-07-29: advisory: ZDI-CAN-29787 and CVE-2026-18299 publicly disclosed