CVE-2026-18649highCWE-770

CVE-2026-18649: high-severity vulnerability in Red Hat Enterprise Linux 10

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

Published 06 Aug 2026 · Updated 23 Sep 2026

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 1.0%

from disclosure to weapon0 days

Published on NVDAug 6

1st PoCAug 6

exploitation probability

1.0%top 39% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

public PoCs found — 1

githubgithub.com/0xSemizzz/CVE-2026-18649★ 4

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Red Hat Enterprise Linux 10

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 40.6%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%

References