CVE-2026-18649highCWE-770

CVE-2026-18649: falha de alta gravidade em Red Hat Enterprise Linux 10

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

Publicada em 06 ago 2026 · Atualizada em 23 set 2026

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.5epss 1.0%

da publicação à arma0 dias

Publicada no NVD6 de ago.

1ª PoC6 de ago.

probabilidade de exploração

1.0%top 39% das CVEs

exploração observada

nãonenhuma fonte reporta

1 exploit(s) público(s)

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Produtos afetados

PoCs públicas encontradas — 1

githubgithub.com/0xSemizzz/CVE-2026-18649★ 4

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

CVEs relacionadas — Red Hat Enterprise Linux 10

No mesmo produto, das mais perigosas para as menos.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.9%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 40.6%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%

Referências