A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1676:05 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)
      * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing     leading to out-of-bounds read/write (CVE-2026-73433)
      * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing     (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1617:03 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56966 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)
      * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing     leading to out-of-bounds read/write (CVE-2026-73433)
      * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing     (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56966 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

    * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading     to out-of-bounds read/write (CVE-2026-73433)

    * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing     (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56966 advisory.

    - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling       Resolves: RHEL-239048
    - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders       Resolves: RHEL-224145

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56966 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under     the LGPL license.

    Security Fix(es):

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

    * gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading     to out-of-bounds read/write (CVE-2026-73433)

    * gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing     (CVE-2026-73434)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:53452 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:53451 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:53452 advisory.

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-53451 advisory.

    [1.26.7-2.3]
    - Fix excessive memory allocation from malicious RTP fragmentation unit       packets in rtph264depay/rtph265depay (CVE-2026-18649)       Resolves: RHEL-224158

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-53452 advisory.

    [1.22.12-7.2]
    - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265       depayloaders to prevent excessive memory usage       Resolves: RHEL-224162

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53451 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under     the LGPL license.

    Security Fix(es):

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53452 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under     the LGPL license.

    Security Fix(es):

    * gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP     depayloaders (CVE-2026-18649)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the dde0fb16-2731-4d3c-aabf-459357235745 advisory.

    The GStreamer project reports:
    Multiple security issues were identified and fixed in the GStreamer framework.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP     depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented     RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments     without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound     until process memory is exhausted. This results in a denial of service through process termination.
    (CVE-2026-18649)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341009	MiracleLinux 8 : gstreamer1-plugins-good-1.16.1-7.el8_10.3 (AXSA:2026-1676:05)	Nessus	Miracle Linux Local Security Checks	Local	medium
339031	MiracleLinux 9 : gstreamer1-plugins-good-1.22.12-7.el9_8.2 (AXSA:2026-1617:03)	Nessus	Miracle Linux Local Security Checks	Local	high
338319	AlmaLinux 8 : gstreamer1-plugins-good (ALSA-2026:56966)	Nessus	Alma Linux Local Security Checks	Local	medium
338233	RockyLinux 8 : gstreamer1-plugins-good (RLSA-2026:56966)	Nessus	Rocky Linux Local Security Checks	Local	medium
338188	Oracle Linux 8 : gstreamer1-plugins-good (ELSA-2026-56966)	Nessus	Oracle Linux Local Security Checks	Local	medium
338174	RHEL 8 : gstreamer1-plugins-good (RHSA-2026:56966)	Nessus	Red Hat Local Security Checks	Local	medium
334867	AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2026:53452)	Nessus	Alma Linux Local Security Checks	Local	high
334842	RockyLinux 10 : gstreamer1-plugins-good (RLSA-2026:53451)	Nessus	Rocky Linux Local Security Checks	Local	high
334835	RockyLinux 9 : gstreamer1-plugins-good (RLSA-2026:53452)	Nessus	Rocky Linux Local Security Checks	Local	high
334815	Oracle Linux 10 : gstreamer1-plugins-good (ELSA-2026-53451)	Nessus	Oracle Linux Local Security Checks	Local	high
334782	Oracle Linux 9 : gstreamer1-plugins-good (ELSA-2026-53452)	Nessus	Oracle Linux Local Security Checks	Local	high
334627	RHEL 10 : gstreamer1-plugins-good (RHSA-2026:53451)	Nessus	Red Hat Local Security Checks	Local	high
334540	RHEL 9 : gstreamer1-plugins-good (RHSA-2026:53452)	Nessus	Red Hat Local Security Checks	Local	high
333499	FreeBSD : gstreamer1 -- multiple vulnerabilities (dde0fb16-2731-4d3c-aabf-459357235745)	Nessus	FreeBSD Local Security Checks	Local	high
333059	Linux Distros Unpatched Vulnerability : CVE-2026-18649	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-18649

high

Tenable Plugins

medium

high

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high