CVE-2026-18299

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gstreamer.freedesktop.org/security/sa-2026-0051.html	Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-467/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de ejecución remota de código por uso después de liberación en GStreamer rtpsbcdepay. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de GStreamer. Se requiere interacción con esta biblioteca para explotar esta vulnerabilidad, pero los vectores de ataque pueden variar dependiendo de la implementación. La falla específica reside en el procesamiento de elementos de carga útil RTP. El problema se debe a la falta de validación de la existencia de un objeto antes de realizar operaciones sobre el objeto. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-29787.

Information

Published : 2026-08-20 17:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-18299

Mitre link : CVE-2026-18299

CVE.ORG link : CVE-2026-18299

JSON object : View

Products Affected

gstreamer

gstreamer

CWE

CWE-416

Use After Free

{"id": "CVE-2026-18299", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18299", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T03:57:14.223895Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "GStreamer", "product": "GStreamer", "versions": [{"status": "affected", "version": "99fde1184fe8b12d0721230941c1bf2080913183"}], "defaultStatus": "unknown"}]}], "published": "2026-08-20T17:17:26.767", "references": [{"url": "https://gstreamer.freedesktop.org/security/sa-2026-0051.html", "tags": ["Patch", "Vendor Advisory"], "source": "zdi-disclosures@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-467/", "tags": ["Third Party Advisory"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo por uso despu\u00e9s de liberaci\u00f3n en GStreamer rtpsbcdepay. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de GStreamer. Se requiere interacci\u00f3n con esta biblioteca para explotar esta vulnerabilidad, pero los vectores de ataque pueden variar dependiendo de la implementaci\u00f3n.\n\nLa falla espec\u00edfica reside en el procesamiento de elementos de carga \u00fatil RTP. El problema se debe a la falta de validaci\u00f3n de la existencia de un objeto antes de realizar operaciones sobre el objeto. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. Fue ZDI-CAN-29787."}], "lastModified": "2026-10-26T10:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7226EA96-BC85-4A91-80A2-87A8C91047BA", "versionEndExcluding": "1.28.5"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}