---
title: GStreamer rtpL16depay heap overflow CVE-2026-111183 (CVSS 9.8): crafted RTP can RCE without a click | ctxsec
url: https://ctxsec.com/items/gstreamer-rtpl16-cve-2026-111183
description: ""
status: "confirmed (ZDI + GStreamer commit)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/gstreamer-rtpl16-cve-2026-111183.md)

confirmed (ZDI + GStreamer commit)

2026-10-15

### GStreamer rtpL16depay heap overflow CVE-2026-111183 (CVSS 9.8): crafted RTP can RCE without a click

Trend Micro's Zero Day Initiative published ZDI-26-775 on Oct 15, 2026 for a heap-based buffer overflow in GStreamer's rtpL16depay RTP payload handler (CVE-2026-111183, CVSS 9.8). A remote attacker who can deliver crafted RTP can overflow a heap buffer and execute code in the process using GStreamer; interaction with the library is required but UI is not. GStreamer landed a fix in commit 80c184b4. Any service that demuxes untrusted RTP/L16 audio (VoIP gateways, media servers, browsers or desktop apps that pull RTP through GStreamer) should rebuild against a patched GStreamer and restart media pipelines. No ITW exploitation is stated in the ZDI advisory.

Sources: [ZDI-26-775](https://www.zerodayinitiative.com/advisories/ZDI-26-775/) · [GStreamer fix commit](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/80c184b4c5ee8ba28b2540ba58f40b8d44b61622)