A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory.
There is no complete mitigation while RTCP processing remains exposed. If RTP/RTCP is not needed, disable the affected RTP session handling elements. Otherwise, restrict the negotiated RTCP port to trusted peers with network controls. These measures reduce exposure but do not correct the parser flaw.