CVE-2026-125712

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

EUVD-2026-120881

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

CVE-2026-125712 Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

CVE-2026-125712

A vulnerability exists in GStreamer's gst-plugins-base RTCP SDES packet parser due to missing bounds checks . A remote sender capable of reaching an active media session can provide a malformed SDES entry where the declared length exceeds the actual packet size. This flaw can cause the receiver t...

CVE-2026-125712: Red Hat: A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

PT-2026-141582

A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer,...

CVE-2026-116784

A flaw was found in FreeSWITCH. A remote attacker participating in an active call can trigger an out-of-bounds read by sending a specially crafted Real-time Transport Control Protocol RTCP packet with an oversized declared length. This flaw can cause the FreeSWITCH service to crash, resulting in ...

CVE-2026-116784

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

CVE-2026-116784 FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

CVE-2026-116784

Versions of FreeSWITCH prior to 1.11.2 are vulnerable to an out-of-bounds read in the process_rtcp_report() function. The root cause is that the software uses an RTPFB NACK packet's declared RTCP header length as a loop bound instead of the previously validated datagram length. An attacker sendin...

CVE-2026-116784 FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

EUVD-2026-117753

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

PT-2026-137712

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2 Description The process rtcp report function uses the declared RTCP header length of an RTPFB NACK packet as its feedback-entry loop bound instead of the validated datagram length. A short packet with an...

CVE-2026-121626

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...

EUVD-2026-116101

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...

CVE-2026-121626

GNU Gatekeeper (gnugk ) before version 5.16 contains an out-of-bounds read vulnerability in the H46024Socket::ReceivedProbePacket() function. A remote attacker can trigger a heap over-read by sending a short, application-defined RTCP packet to the media port while the system is undergoing H.460.2...

CVE-2026-121626 GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...

CVE-2026-121626 GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...

CVE-2026-121625 GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with...

CVE-2026-121625 GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with...