CVE-2026-111183

A flaw was found in GStreamer. A remote attacker can achieve arbitrary code execution by sending specially crafted Real-time Transport Protocol (RTP) stream packets to applications using the rtpL16depay plugin. This issue occurs due to a lack of proper validation on the length of incoming payload data before copying it to a memory buffer, resulting in a heap-based buffer overflow. Successful exploitation allows unauthorized code execution in the context of the running application.

The GStreamer advisory states the trigger requires the "application connect to a crafted RTSP stream or complete SDP negotiation with an attacker-controlled peer." For desktop media players, this requires the user to open a malicious URL. The ZDI advisory itself acknowledges "attack vectors may vary depending on the implementation. There's no PoC at this time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.