ZDI-26-775: GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a CVSS 9.8 heap overflow in GStreamer rtpL16depay that can allow remote code execution.
The Zero Day Initiative published ZDI-26-775, a heap-based buffer overflow in GStreamer's rtpL16depay element. Remote attackers can execute arbitrary code on affected installations, though interaction with the library is required and vectors depend on the implementation. ZDI assigned CVSS 9.8 and CVE-2026-111183. The advisory does not report observed exploitation.
- Heap-based buffer overflow in GStreamer rtpL16depay
- ZDI rates the issue CVSS 9.8
- Remote code execution requires interaction with the library
- Tracked as CVE-2026-111183; exploitation not reported
- CVEs
- CVE-2026-111183
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111183 | Heap buffer overflow RCE in GStreamer rtpL16depay | 9.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.