CVE-2026-121625 in Gnugk
Summary
by MITRE • 11/03/2026
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The GNU Gatekeeper, specifically versions prior to 5.16, contains a critical out-of-bounds read vulnerability located within the ParseRTCP function in the ProxyChannel.cxx source file. This flaw is classified under CWE-125 as an Out-of-Bounds Read and allows remote attackers with access to the media proxy port to perform unauthorized memory reads. The vulnerability arises from insufficient bounds checking when processing Real-time Transport Control Protocol packets, which are integral components of H.323 multimedia communication sessions. When a gatekeeper is configured to enable RTCP statistics collection via the EnableRTCPStats directive, it actively parses incoming control packets to gather performance metrics and session data. However, the parsing logic fails to adequately validate the length fields or buffer boundaries associated with specific RTCP packet types, creating a scenario where memory access extends beyond the allocated heap space for received packets.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through application crashes. An attacker can exploit this flaw by sending specially crafted RTCP Source Description items that lack the required NUL byte termination character to the media proxy port during an active or proxied H.323 call. The absence of the NUL byte causes the parsing routine to continue reading memory until it encounters a null value elsewhere in the heap, effectively performing an out-of-bounds read. This unauthorized access not only compromises the integrity of the application by potentially leaking sensitive information stored adjacent to the packet buffer but also leads to immediate instability and termination of the GNU Gatekeeper process due to segmentation faults or illegal memory access violations.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1046, Network Service Discovery, as it involves interacting with network services to probe for weaknesses, although the primary exploitation vector here is denial-of-service rather than information exfiltration in most practical scenarios due to the crash nature of the bug. The attack requires the attacker to be on a network segment that can reach the gatekeeper's media proxy port and must occur during an H.323 session where RTCP statistics are enabled, limiting its scope but increasing the severity for targeted VoIP infrastructure.
Mitigation strategies should focus primarily on upgrading the GNU Gatekeeper software to version 5.16 or later, which includes patches addressing this specific parsing error in ProxyChannel.cxx. For environments where immediate patching is not feasible, administrators can mitigate the risk by disabling RTCP statistics collection through the configuration directive EnableRTCPStats set to false if such metrics are not strictly required for network monitoring. Additionally, deploying a Web Application Firewall or VoIP-specific intrusion prevention system capable of inspecting and filtering malformed RTCP packets before they reach the gatekeeper can provide an additional layer of defense against exploitation attempts by blocking traffic that exhibits characteristics of this specific out-of-bounds read trigger.