CVE-2026-18649 is a denial of service vulnerability in the GStreamer gst-plugins-good package's rtph264depay and rtph265depay elements. These elements fail to enforce a maximum size limit on their reassembly buffers when processing fragmented RTP packets. An attacker can send a continuous stream of RTP fragments without an end-of-fragment marker, causing the buffer to grow without bound and exhausting process memory, leading to process termination. The vulnerability requires no authentication and has a network attack vector with low complexity. It primarily affects deployments that process raw unauthenticated RTP over UDP. Deployments using SRTP or DTLS-SRTP are protected as these protocols authenticate packets before depayloading. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling).

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by exhausting process memory through unbounded growth of the RTP fragment reassembly buffer. There is no impact on confidentiality or integrity, only availability is affected. The attack leads to process termination, disrupting media streaming or processing services that use the affected GStreamer elements.

No official patch is currently confirmed available. Mitigations to reduce risk before a patch include: 1) Use SRTP or DTLS-SRTP to provide per-packet authentication, which blocks unauthenticated fragments before they reach the vulnerable depayloaders. 2) Restrict RTP traffic sources at the network level using firewall rules to allow only trusted peers. 3) Disable the RTP plugin entirely at build time with the meson option "-Drtp=disabled" to remove the vulnerable elements. 4) Prevent automatic use of the vulnerable elements at runtime by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. These mitigations reduce or eliminate exposure until a patch is released.