CVE-2026-18299 is a use-after-free vulnerability in the GStreamer rtpsbcdepay component that enables remote code execution. The vulnerability is due to a failure to validate the existence of an object before performing operations on RTP payload elements, leading to memory corruption. An attacker who can interact with the affected library may execute arbitrary code within the context of the current process. The vulnerability was reported to the vendor on 2026-05-21 and publicly disclosed on 2026-07-29. GStreamer has released a security update to fix this issue.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the affected process, potentially leading to full compromise of the system running the vulnerable GStreamer version. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

GStreamer has issued an official update that corrects this vulnerability. Users and administrators should apply the vendor-provided patch as detailed in the advisory at https://gstreamer.freedesktop.org/security/sa-2026-0051.html. No alternative mitigations are specified; applying the official fix is required to remediate the issue.