Zero Radar
← feed
CriticalVulnerabilityCVE-2026-111183updated 26 Oct 2026, 07:57 UTC

GStreamer media library can be crashed or hijacked via RTP audio data

GStreamer is a library many apps use to play audio and video. A specially crafted network stream can overflow memory in its RTP handling, which may let an attacker crash the app or run their own code on the machine.

Official, 3 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerCrafts malicious RTP audio packets
  2. 2Network streamPackets reach the media application
  3. 3rtpL16depayCopies data without length check
  4. 4Heap overflowMemory beyond buffer is overwritten
  5. ResultAttacker may run code in the app

What happened

A heap-based buffer overflow in the rtpL16depay RTP payload depayloader of GStreamer lets remote input overrun a heap buffer because its length is not validated before copying. Germany's BSI also reports several further GStreamer flaws that can corrupt data, cause denial of service, leak information, or possibly execute code.

Why it is dangerous: An attacker who can send crafted RTP media to an affected application may run arbitrary code in that process, or at least crash it. Anyone using apps or services that process RTP streams with GStreamer is at risk.

Are you affected?

You are affected if you run GStreamer with the rtpL16depay element (for example in media players, streaming or VoIP-style apps) and receive RTP audio from untrusted sources.

What to do

  1. Identify whether your applications or systems use GStreamer and check the vendor or distribution for an updated GStreamer package
  2. Apply the GStreamer security update as soon as it is available for your platform
  3. Until patched, limit RTP input to trusted sources and block untrusted RTP traffic at the network edge

Timeline

  1. 21 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 19:06 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 26 Oct 2026, 07:57 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-111183 · GHSA-62fg-53h6-6f68
CVSS
9.8 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 07:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GStreamer media library can be crashed or hijacked via RTP audio data · Zero Radar