Bug 2547479

Summary:	CVE-2026-18649 mingw-gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders [fedora-all]
Product:	[Fedora] Fedora	Reporter:	lcelant
Component:	mingw-gstreamer1-plugins-good	Assignee:	Marc-Andre Lureau <marcandre.lureau>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	eblima, manisandro, marcandre.lureau
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["b6533763-1e9d-4d6a-9785-0a3d6b0a0a3d"]}
Fixed In Version:	mingw-gstreamer1-plugins-good-1.28.8-1.fc44 mingw-gstreamer1-plugins-good-1.28.8-1.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-28 02:27:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2510614

Description lcelant 2026-10-07 14:43:45 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer gst-plugins-good contains an unbounded memory growth vulnerability in the rtph264depay and rtph265depay RTP depayloaders. In gstrtph264depay.c, the FU-A/FU-B fragmentation handler (case 28/29 in gst_rtp_h264_depay_process()) accumulates incoming RTP fragment payloads into a GstAdapter via gst_adapter_push() without enforcing any maximum reassembly size. The adapter is only flushed when the E (end) bit is set in the FU header, which triggers gst_rtp_h264_finish_fragmentation_unit(). If an attacker sends a start fragment (S=1, E=0) followed by an unlimited stream of continuation fragments (S=0, E=0) with sequential RTP sequence numbers, the adapter grows without bound until process memory is exhausted. The same flaw exists in gstrtph265depay.c in the FU handler (case 49 in gst_rtp_h265_depay_process()). The GStreamer security team confirmed the vulnerability and that rtph265depay is also affected. A fix is pending in private security Merge Request 113, planned for release in GStreamer 1.28.6 or 1.28.7. Confirmed on GStreamer 1.28.2 and 1.28.5 (dynamic testing). Reported by Yehia Ali Mohamed Ezzat (yehiaezzat710). PSIRT Ticket: PSIRTSUPT-20847.

Comment 1 Fedora Update System 2026-10-19 10:04:01 UTC

FEDORA-2026-343461e9d1 (mingw-gstreamer1-1.28.8-1.fc44, mingw-gstreamer1-plugins-bad-free-1.28.8-1.fc44, and 2 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-343461e9d1

Comment 2 Fedora Update System 2026-10-19 10:05:04 UTC

FEDORA-2026-b1f189a5b6 (mingw-gstreamer1-1.28.8-1.fc45, mingw-gstreamer1-plugins-bad-free-1.28.8-1.fc45, and 2 more) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b1f189a5b6

Comment 3 Fedora Update System 2026-10-20 04:31:53 UTC

FEDORA-2026-b1f189a5b6 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b1f189a5b6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b1f189a5b6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-10-20 05:27:39 UTC

FEDORA-2026-343461e9d1 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-343461e9d1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-343461e9d1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-28 02:27:19 UTC

FEDORA-2026-343461e9d1 (mingw-gstreamer1-1.28.8-1.fc44, mingw-gstreamer1-plugins-bad-free-1.28.8-1.fc44, and 2 more) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2026-10-31 18:47:26 UTC

FEDORA-2026-b1f189a5b6 (mingw-gstreamer1-1.28.8-1.fc45, mingw-gstreamer1-plugins-bad-free-1.28.8-1.fc45, and 2 more) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.