Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Vendor: MediumRed Hat Linux

High [CVE-2026-18649] unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders

This high-severity Red Hat Linux advisory covers CVE-2026-18649 affecting Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 10.0 Extended Update Support.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-18649 Source published Source updated

VulniPulse record published Record updated

CVE-2026-18649
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders. Red Hat rates this moderate (CVSS 7.5).

Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:53451 with package gstreamer1-plugins-good-0:1.26.7-2.el10_2.3, gstreamer1-plugins-good-0:1.22.12-7.el9_8.2, gstreamer1-plugins-good-0:1.16.1-7.el8_10.3.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.

Affected products named by the advisory: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; and 7 more.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • gstreamer1-plugins-good-0:1.26.7-2.el10_2.3
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2
  • gstreamer1-plugins-good-0:1.16.1-7.el8_10.3
  • RHSA-2026:53451

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • The following mitigations can reduce risk before a patch is available: 1. Use SRTP or DTLS-SRTP: Deploy the srtpdec element in the pipeline before the depayloader. SRTP provides per-packet authentication and will reject unauthenticated fragments before they reach rtph264depay/rtph265depay, completely preventing exploitation. 2. Network-level restriction: Use firewall rules (iptables/nftables) to restrict which sources can send RTP traffic to the GStreamer process. Allow RTP only from trusted, authenticated peers. 3. Build-time exclusion: Disable the entire RTP plugin by configuring with "-Drtp=disabled" in meson build options. This removes all RTP functionality including the vulnerable depayloaders. 4. Runtime element exclusion: Prevent the affected elements from being auto-plugged by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. This prevents automatic selection but not explicit pipeline construction.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.