CVE-2026-18649 is a resource exhaustion vulnerability in the GStreamer gst-plugins-good package's rtph264depay and rtph265depay RTP depayloader elements. These elements lack enforcement of a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. An attacker can send a continuous stream of RTP fragments without an end-of-fragment marker, causing the buffer to grow without bound until process memory is exhausted, resulting in denial of service through process termination. The vulnerability affects scenarios where RTP streams are received from unauthenticated sources, such as raw RTP over UDP feeding directly into the depayloaders. Use of SRTP or DTLS-SRTP provides per-packet authentication, preventing exploitation by rejecting unauthenticated packets. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with no confidentiality or integrity impact but high availability impact. Red Hat has published mitigations and a security update for Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10 is under investigation. Mitigations include deploying SRTP/DTLS-SRTP, network-level source restrictions, disabling the RTP plugin at build time, or preventing auto-plugging of the affected elements at runtime.

The vulnerability allows a remote, unauthenticated attacker to cause unbounded memory growth in the RTP fragment reassembly buffer, leading to denial of service by exhausting process memory and causing process termination. There is no impact on confidentiality or integrity. The practical impact depends on whether RTP streams are authenticated; deployments using SRTP or DTLS-SRTP reject unauthenticated packets and are not exposed. Systems receiving raw unauthenticated RTP over UDP feeding directly into the vulnerable depayloaders are at risk.

A patch is available for Red Hat Enterprise Linux 9 as per Red Hat Advisory RHSA-2026:53452. For Red Hat Enterprise Linux 10, patch status is not yet confirmed—check the vendor advisory for updates. Before patching, mitigations include: 1) Using SRTP or DTLS-SRTP to provide per-packet authentication and reject unauthenticated RTP fragments before they reach the vulnerable depayloaders; 2) Applying network-level restrictions (firewall rules) to allow RTP traffic only from trusted, authenticated sources; 3) Disabling the RTP plugin at build time with the "-Drtp=disabled" option; 4) Preventing auto-plugging of rtph264depay and rtph265depay elements by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. These mitigations reduce or eliminate the attack surface until an official fix is applied.