{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-18299","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2026-08-20T17:17:26.767","lastModified":"2026-10-26T10:10:00.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código por uso después de liberación en GStreamer rtpsbcdepay. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de GStreamer. Se requiere interacción con esta biblioteca para explotar esta vulnerabilidad, pero los vectores de ataque pueden variar dependiendo de la implementación.\n\nLa falla específica reside en el procesamiento de elementos de carga útil RTP. El problema se debe a la falta de validación de la existencia de un objeto antes de realizar operaciones sobre el objeto. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-29787."}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"GStreamer","product":"GStreamer","defaultStatus":"unknown","versions":[{"version":"99fde1184fe8b12d0721230941c1bf2080913183","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T03:57:14.223895Z","id":"CVE-2026-18299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*","versionEndExcluding":"1.28.5","matchCriteriaId":"7226EA96-BC85-4A91-80A2-87A8C91047BA"}]}]}],"references":[{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0051.html","source":"zdi-disclosures@trendmicro.com","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-467/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]}]}}