CVE-2026-18649

Отчет

The gstreamer1-plugins-good package ships the rtph264depay and rtph265depay elements in multiple products including Fedora and RHEL. The vulnerability is exploitable when these depayloaders process RTP from untrusted sources without an authentication layer. In deployments using SRTP (via srtpdec) or DTLS-SRTP (via WebRTC/webrtcbin), unauthenticated packets are rejected before reaching the depayloaders, which significantly reduces the attack surface. However, pipelines receiving raw unauthenticated RTP over UDP (e.g. udpsrc directly feeding rtph264depay) are fully exposed. The practical impact depends on whether the deployment uses authenticated RTP transport. Desktop media playback from local files is not affected.

Меры по смягчению последствий

The following mitigations can reduce risk before a patch is available:

1. Use SRTP or DTLS-SRTP: Deploy the srtpdec element in the pipeline before the depayloader. SRTP provides per-packet authentication and will reject unauthenticated fragments before they reach rtph264depay/rtph265depay, completely preventing exploitation.
2. Network-level restriction: Use firewall rules (iptables/nftables) to restrict which sources can send RTP traffic to the GStreamer process. Allow RTP only from trusted, authenticated peers.
3. Build-time exclusion: Disable the entire RTP plugin by configuring with "-Drtp=disabled" in meson build options. This removes all RTP functionality including the vulnerable depayloaders.
4. Runtime element exclusion: Prevent the affected elements from being auto-plugged by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. This prevents automatic selection but not explicit pipeline construction.