Main Vulnerability Database Vulnerabilities #VU141155

Out-of-bounds read in gst-plugins-ugly and gstreamer - #VU141155

Published: August 6, 2026

Vulnerability identifier: #VU141155

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the ASF-over-RTP depayloader element (rtpasfdepay) when processing crafted RTP packets with ASF payload data. A remote attacker can send crafted RTP packets to cause a denial of service.

Optional RTP header fields were read before bounds validation, and ASF packet header fields were parsed without checking that the offset remains within the allocated buffer.

Affected software

gst-plugins-ugly
gstreamer

Remediation

Install security update from vendor's website.

gst-plugins-ugly - update to 1.28.5
gstreamer - update to 1.28.5

External References

Related Security Bulletins