CVE-2026-18649 is a denial of service vulnerability in the GStreamer gst-plugins-good package affecting Red Hat Enterprise Linux 10. The rtph264depay and rtph265depay RTP depayloader elements fail to enforce maximum size limits on their reassembly buffers during fragmented RTP packet processing. An attacker can send a continuous stream of RTP fragments without an end-of-fragment marker, causing the buffer to grow without bound and exhaust process memory, leading to process termination. The vulnerability is exploitable when RTP streams are received from unauthenticated sources without SRTP or DTLS-SRTP protection. Deployments using authenticated RTP reject unauthenticated packets before they reach the vulnerable elements, significantly reducing risk. Mitigations include deploying SRTP or DTLS-SRTP, restricting RTP sources via firewall rules, disabling RTP plugins at build time, or preventing auto-plugging of the vulnerable elements at runtime. No official fix or patch has been confirmed by Red Hat at this time.

The vulnerability allows remote, unauthenticated attackers to cause a denial of service by exhausting memory resources of the process handling RTP streams. There is no impact on confidentiality or integrity. The severity is high due to the potential for process termination and service disruption. The practical impact depends on whether RTP streams are authenticated; deployments using SRTP or DTLS-SRTP are protected from exploitation. Unauthenticated RTP streams processed directly by the vulnerable depayloader elements are fully exposed to this attack.

Red Hat has not confirmed an official patch or fix for this vulnerability yet. Until a patch is available, the following mitigations are recommended: 1) Use SRTP or DTLS-SRTP to provide per-packet authentication and reject unauthenticated RTP fragments before they reach the vulnerable depayloader elements. 2) Apply network-level restrictions via firewall rules to allow RTP traffic only from trusted, authenticated sources. 3) Disable the RTP plugin entirely at build time using the "-Drtp=disabled" meson build option to remove the vulnerable elements. 4) Prevent the vulnerable elements from being auto-plugged at runtime by setting GST_PLUGIN_FEATURE_RANK=rtph264depay:0,rtph265depay:0. These mitigations reduce or eliminate the attack surface until an official fix is released.