CVE-2026-125712 Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125712?
CVE-2026-125712 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 10 Nov 2026.
Official description
A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
Weakness: CWE-125
Which versions are affected by CVE-2026-125712?
Linux distribution packages (12)
gstreamer1-plugins-base AlmaLinux:8 | All versions | 1.16.1-8.el8_10 |
gstreamer1-plugins-base-devel AlmaLinux:8 | All versions | 1.16.1-8.el8_10 |
gstreamer1-plugins-base Rocky Linux:8 | All versions | 0:1.16.1-8.el8_10 |
gstreamer1-plugins-base-debuginfo Rocky Linux:8 | All versions | 0:1.16.1-8.el8_10 |
gstreamer1-plugins-base-debugsource Rocky Linux:8 | All versions | 0:1.16.1-8.el8_10 |
gstreamer1-plugins-base-devel Rocky Linux:8 | All versions | 0:1.16.1-8.el8_10 |
gstreamer1-plugins-base Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
gstreamer1-plugins-base-debuginfo Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
gstreamer1-plugins-base-debugsource Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
gstreamer1-plugins-base-devel Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
gstreamer1-plugins-base-tools Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
gstreamer1-plugins-base-tools-debuginfo Rocky Linux:9 | All versions | 0:1.22.12-10.el9_9.1 |
How do I fix CVE-2026-125712?
Upgrade to a fixed version.
Is CVE-2026-125712 being exploited?
There is no known exploitation of CVE-2026-125712 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:99012, DEBIAN-CVE-2026-125712, ECHO-c72c-f68e-06c4, GHSA-33rv-cmmp-jr52, RLSA-2026:99012, RLSA-2026:99126 and 1 more.