A vulnerability in the GStreamer gst-plugins-good package affects the rtph264depay and rtph265depay RTP depayloader elements. These elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. An unauthenticated remote attacker can exploit this by sending a continuous stream of RTP fragments without an end-of-fragment marker, causing unbounded memory growth and denial of service via process termination. The risk is significant when processing unauthenticated RTP streams, but mitigations such as using SRTP or DTLS-SRTP, network restrictions, or disabling the RTP plugin reduce exposure.