CVE-2026-111183: Heap buffer overflow in GStreamer RTP depayloading

gst-plugins-good1.0 Updated 23 Oct 2026

Summary

23/10/2026

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

DEBIAN-CVE-2026-111183: Malformed RTP payload lengths can trigger a heap buffer overflow, allowing remote code execution in the process handling the media. Affects gst-plugins-good1.0 versions 1.22.0-5 – 1.29.2-1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

gst-plugins-good1.0 is a package in the Debian ecosystem that provides GStreamer plugins. GStreamer is a multimedia framework, and this package includes the rtpL16depay component for processing RTP payload elements. Applications that use this component to handle RTP media may be exposed when they process attacker-controlled payloads.

Vulnerability Detail

Remote code execution is possible through a heap-based buffer overflow in GStreamer’s rtpL16depay component. The flaw occurs when processing RTP payload elements: user-supplied data length is not properly validated before data is copied into a heap buffer. Exploitation requires interaction with the library, and attack vectors may vary by implementation. An attacker may execute arbitrary code in the context of the process handling the payload.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

AI-generated workaround (not vendor-documented): Disable RTP L16 depayloading where possible, or restrict RTP input to trusted sources. Validate payload lengths before processing them; the following generic example illustrates a defensive length check, not vendor guidance.

if (payload_length > MAX_ALLOWED_PAYLOAD) {
    reject_payload();
}

Conclusion

No fixed version is published for gst-plugins-good1.0 in Debian:12. Restrict untrusted RTP input and disable the affected depayloading feature where feasible until a fix is available. Review application manifests or SBOMs to identify use of the package. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.

See every vulnerability recorded for gst-plugins-good1.0 →