Low severity3.7NVD Advisory· Published Nov 3, 2026

CVE-2026-121625

Description

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

Affected products

Willamowius/gnugkllm-create
Range: <5.16
GNU Gatekeeper/GNU Gatekeeperllm-fuzzy
Range: <5.16

Patches

Vulnerability mechanics

References

github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxxnvd
github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777nvd
github.com/willamowius/gnugk/releases/tag/v5_16nvd
www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsingnvd

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000