CVE-2026-18299: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-18299 is a use-after-free (UAF) vulnerability in GStreamer's rtpsbcdepay component that allows remote attackers to execute arbitrary code on affected installations. The flaw exists within the processing of RTP payload elements, where the code fails to validate the existence of an object before performing operations on it. It was reported to the vendor on 2026-05-21, with coordinated public disclosure on 2026-07-29 and NVD publication on 2026-08-20. The vulnerability carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free) and resides in GStreamer's rtpsbcdepay plugin, which handles RTP payload depayloading for SBC audio streams. The flaw occurs because the code does not validate whether an object still exists before operating on it during RTP payload element processing; after memory is freed, a subsequent reference to that memory region can be leveraged by an attacker to achieve arbitrary code execution. Exploitation requires user interaction — such as opening a malicious RTP stream or media file — and the attack vector is local, meaning the attacker must be able to influence the media content processed by GStreamer. The vulnerability was originally tracked as ZDI-CAN-29787 and was discovered by researcher DongHyeon Hwang (kind_killerwhale) (ZDI Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the context of the GStreamer process, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker who tricks a user into opening a crafted RTP stream or media file could gain full control of the process, potentially accessing sensitive data, modifying files, or causing a denial of service. The scope is unchanged, meaning the impact is contained to the vulnerable component's security context, but code execution within a media-processing process can still serve as a foothold for further lateral movement depending on the deployment environment (ZDI Advisory, GitHub Advisory).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable, as it requires user interaction. The EPSS score is 0.0, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (ZDI Advisory, GitHub Advisory).

1. Craft malicious media: Prepare a specially crafted RTP stream or media file that triggers the use-after-free condition in GStreamer's rtpsbcdepay plugin during SBC RTP payload depayloading.
2. Deliver to target: Deliver the malicious file or stream to the target user via email attachment, web download, shared network resource, or a malicious streaming server — exploiting the fact that attack vectors vary by implementation.
3. Trigger user interaction: Induce the target user to open or play the malicious media using an application that relies on GStreamer for media processing (e.g., a media player, VoIP client, or browser with GStreamer backend).
4. Exploit UAF condition: When GStreamer processes the RTP payload elements, the freed memory object is referenced without validation, allowing the attacker to control the freed memory region (e.g., via heap grooming) and redirect execution flow.
5. Achieve code execution: The attacker's controlled data in the freed memory region is used to execute arbitrary code in the context of the GStreamer process, enabling payload delivery, data exfiltration, or further system compromise (ZDI Advisory).

• Network: Unexpected outbound connections from a media player or GStreamer-backed application process to unknown external hosts following media file playback; receipt of RTP streams from untrusted or unknown sources.
• Process: Unusual child processes spawned by GStreamer-linked applications (e.g., bash, sh, curl, wget, python) after opening a media file; crashes or segmentation faults in GStreamer processes (gst-launch, media player backends) that may indicate failed exploitation attempts.
• File System: Unexpected files written to temporary directories or user home directories by media-processing applications; new scripts or executables created shortly after media playback events.
• Logs: Application crash logs or core dumps referencing rtpsbcdepay or RTP payload processing functions; system logs showing abnormal process behavior from GStreamer-linked applications.

GStreamer has issued a security update to address this vulnerability, detailed in security advisory SA-2026-0051. Users should update GStreamer to the patched version referenced in the vendor advisory as the primary remediation step. As a workaround prior to patching, avoid opening RTP stream files or media content from untrusted or unknown sources, and restrict access to GStreamer-based media playback functionality to trusted inputs only (GStreamer Advisory, ZDI Advisory).