RHSA-2026:53452MediumCVSS 7.5

Red Hat Security Advisory: gstreamer1-plugins-good security update

Published
August 11, 2026
Last Modified
August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-18649 →

📋 Description

CVE-2026-18649 — gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debuginfo-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-debugsource-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-7.el9_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-7.el9_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following mitigations can reduce risk before a patch is available: 1. Use SRTP or DTLS-SRTP: Deploy the srtpdec element in the pipeline before the depayloader. SRTP provides per-packet authentication and will reject unauthenticated fragments before they reach rtph264depay/rtph265depay, completely preventing exploitation. 2. Network-level restriction: Use firewall rules (iptables/nftables) to restrict which sources can send RTP traffic to the GStreamer process. Allow RTP only from trusted, authenticated peers. 3. Build-time exclusion: Disable the entire RTP plugin by configuring with "-Drtp=disabled" in meson build options. This removes all RTP functionality including the vulnerable depayloaders. 4. Runtime element exclusion: Prevent the affected elements from being auto-plugged by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. This prevents automatic selection but not explicit pipeline construction.

🔗 References (4)