Repository navigation
Mitigate CVE-2026-119610 in the GStreamer backend (disable rtph264depay on < 1.28.9) - #1
Open
RoadToMythicGlory wants to merge 4 commits into
Open
RoadToMythicGlory wants to merge 4 commits into
RoadToMythicGlory wants to merge 4 commits into
Conversation
…6-119610) RTSP inputs are decoded with rtspsrc ! decodebin3, which autoplugs rtph264depay. In gst-plugins-good < 1.28.9 a single malformed RTP packet triggers an out-of-bounds heap read (GStreamer SA-2026-0095). - media-core checks the loaded "rtp" plugin version after gst_init and exits with a security error if it is older than 1.28.9. - gst_probe reports plugins_good_version / vulnerable_cve_2026_119610 and marks the environment not ready when vulnerable. - GstProgramOutputManager refuses to spawn media-core on a vulnerable install and surfaces the reason in last_error. - Tests for version parsing, the gate and the spawn refusal; README notes the 1.28.9 minimum. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019djRQNVy1x6waBp7puF1d7
Installs the official MSVC x86_64 runtime + devel MSIs (checksum-verified, cached), builds media-core, fails if CMake skipped the binary, runs the unit tests, and checks the CVE-2026-119610 startup gate accepts 1.28.9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019djRQNVy1x6waBp7puF1d7
GStreamer 1.28 ships one Inno Setup installer instead of separate runtime and devel MSIs, so the MSI URLs 404'd. Install it silently with the full type, locate the root from gstreamer-1.0.pc, and fail fast on a 404 instead of retrying. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019djRQNVy1x6waBp7puF1d7
…g to run GStreamer has not published Windows binaries for 1.28.9 (1.28.8 is the newest), so a hard >= 1.28.9 gate would disable the GStreamer backend on Windows with no upgrade available. - media-core now removes rtph264depay from the registry on plugins-good < 1.28.9, so decodebin3 can never plug the vulnerable element. It only exits (code 2) if the element cannot be disabled. - Python no longer refuses to spawn; it logs a warning and the probe reports rtp_h264_input_disabled. - Windows CI builds against 1.28.8 (pinned SHA-256) and checks that the mitigation is applied. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019djRQNVy1x6waBp7puF1d7
RoadToMythicGlory
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Excalibur's GStreamer program-output backend is exposed to CVE-2026-119610 (GStreamer SA-2026-0095) on gst-plugins-good older than 1.28.9: RTSP inputs go through
rtspsrc ! decodebin3, which autoplugsrtph264depay, and one malformed RTP packet triggers an out-of-bounds heap read.GStreamer has not published Windows binaries for 1.28.9 yet (1.28.8 is the newest), so instead of refusing to run, this PR removes the vulnerable element:
rtph264depayfrom the registry at startup when plugins-good is < 1.28.9, so it can never be plugged. It exits with asecurityerror only if the element cannot be disabled.plugins_good_version,vulnerable_cve_2026_119610andrtp_h264_input_disabled; the output manager logs a warning before spawning.media-core (Windows)): installs official GStreamer 1.28.8 (pinned SHA-256), builds media-core, runs unit tests, and checks the mitigation is applied.Test plan
pytest— 183 passedrtph264depay disabledat startupGST_VERSION/GST_SHA256in the workflowhttps://claude.ai/code/session_019djRQNVy1x6waBp7puF1d7
Generated by Claude Code