# CVE-2026-18299: GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing

Source: https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18299 · Severity: high · CVSS 7.8 · Published 2026-08-20

GStreamer is a multimedia library used by applications to process audio and video streams. A vulnerability in the RTP SBC (Bluetooth audio codec) component allows an attacker to send a specially crafted network packet that causes the application to crash or potentially execute arbitrary code, disrupting media playback and potentially compromising the affected system.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-18299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18299 being exploited in the wild.

**How severe is CVE-2026-18299?** High severity, with a CVSS score of 7.8, published 20 August 2026.

**Which products and versions are affected?** GStreamer gst-plugins-good < 1.28.5.

**Is there a fix for CVE-2026-18299?** A patch was published on 2026-07-08: GStreamer 1.28.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18299 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18299?** Check whether you run Gstreamer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The rtpsbcdepay element in gst-plugins-good fails to validate the size of incoming RTP payload data before parsing the SBC-specific payload header, resulting in an out-of-bounds read. Additionally, the element does not check whether the reassembly adapter contains data before extracting a buffer and fails to reset buffer variables to NULL after transferring ownership, leading to use-after-free of a GstBuffer object. The vulnerability is triggered by sending a crafted RTP packet with minimal or no payload data to a network-reachable application—no authentication or user interaction is required. In standard builds with assertions enabled, the impact is limited to denial of service via critical warnings or crash; in builds with assertions disabled, use-after-free occurs but practical impact remains DoS-focused since freed memory is read at fixed offsets rather than affecting control flow. GStreamer 1.28.5 addresses the issue.

## Affected products

- GStreamer gst-plugins-good < 1.28.5

## Timeline

- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-07-08: patched: GStreamer 1.28.5 released with fix
- 2026-07-29: advisory: ZDI-CAN-29787 and CVE-2026-18299 publicly disclosed

## References

- [https://gstreamer.freedesktop.org/security/sa-2026-0051.html](https://gstreamer.freedesktop.org/security/sa-2026-0051.html)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-467/](https://www.zerodayinitiative.com/advisories/ZDI-26-467/)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer gst-plugins-good heap buffer overflow in GdkPixbuf decoder](https://junglewise.ai/threats/cve-2026-18298-gstreamer-gst-plugins-good-heap-buffer-overflow-in-gdkpixbuf)