GStreamer rtpL16depay: Heap-based buffer overflow leading to remote code execution
Summary
A heap-based buffer overflow in the rtpL16depay element of GStreamer allows remote attackers to execute arbitrary code in the context of the affected process. The flaw lies in the processing of RTP payload data, where user-supplied data is copied to a heap buffer without validating its length. Exploitation requires an application that uses GStreamer to process RTP L16 audio, and attack vectors depend on the implementation.
Affected
- GStreamer (rtpL16depay element, GStreamer Good Plug-ins)
- Affected versions not officially stated by the vendor. Distribution data indicates GStreamer 1.28.7 (master) and 1.26.11 (release-26.05) as affected packages.
Fixed in
- GStreamer 1.28.8 (according to the Nixpkgs tracker)
- Fix commit referenced by the vendor: 80c184b4c5ee8ba28b2540ba58f40b8d44b61622
- Fixed version for the 1.26.x branch: Unknown.
- Distribution patch status: Ubuntu lists gst-plugins-good1.0 as Needs evaluation.
Workaround
- Unknown.
- Do not accept RTP L16 audio from untrusted networks and restrict RTP/UDP ingress to trusted peers.
Exploitation
- Not listed in the CISA KEV catalogue.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof of concept found at the time of research.
Our recommendation
- Inventory hosts and appliances that use GStreamer and gst-plugins-good.
- Update to GStreamer 1.28.8 or later, or install the distribution patch once available.
- Restrict RTP audio ingress to trusted peers and treat internet-facing RTP audio services as high priority.
- Monitor vendor and distribution advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-775 advisory www.zerodayinitiative.com
- GStreamer fix commit 80c184b4 gitlab.freedesktop.org
- OpenCVE CVE-2026-111183 app.opencve.io
- Ubuntu security CVE-2026-111183 ubuntu.com
- Nixpkgs tracker issue 577720 github.com
- GStreamer rtpL16depay documentation GStreamer.freedesktop.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:05.
Original description (NVD)
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.