A vulnerability in GStreamer's gst-plugins-base RTCP SDES packet parser allows a remote sender to supply a malformed SDES entry with a declared length exceeding the packet size. This missing bounds validation can cause out-of-bounds reads, potentially crashing the application or exposing limited process memory. The flaw affects multiple Red Hat and Fedora versions, with fixes available in newer releases. Mitigations include disabling RTP/RTCP if unused or restricting RTCP ports to trusted peers, but no complete mitigation exists without patching.