CVE-2026-111183: GStreamer rtpL16depay Heap Buffer Overflow (CVSS 9.8) — Detection and Remediation Guide

---
title: GStreamer Media Process Spawning Shell or Script Interpreter
description: Detects a GStreamer binary or known GStreamer-dependent media process spawning a shell, script interpreter, or download utility — consistent with post-exploitation activity following memory corruption of a media pipeline (e.g., CVE-2026-111183 rtpL16depay).
author: Security Arsenal
date: 2026/02/10
status: experimental
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-775/
  - https://attack.mitre.org/techniques/T1203/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gst-launch-1.0'
      - '/gst-play-1.0'
      - '/gst-discoverer-1.0'
      - '/totem'
      - '/rhythmbox'
      - '/cheese'
      - '/pitivi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate GStreamer applications do not normally spawn shells or download tools. Custom pipeline wrappers in transcoding farms should be reviewed.
level: high
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
---
title: Crash Artifacts from GStreamer-Linked Media Processes
description: Detects repeated crashes of GStreamer-dependent media processes, which may indicate heap overflow probing or failed exploitation attempts against the rtpL16depay element (CVE-2026-111183).
author: Security Arsenal
date: 2026/02/10
status: experimental
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-775/
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'gstreamer'
      - 'rtpL16depay'
      - 'GstRtpL16Depay'
    Image|endswith:
      - '/apport'
      - '/systemd-coredump'
      - '/abrt-hook-ccpp'
      - '/crashpad_handler'
  condition: selection
falsepositives:
  - Legitimate media pipeline instability; investigate source IP and RTP session history on any hit.
level: medium
tags:
  - attack.initial_access
  - attack.t1190

// Hunt: GStreamer-linked processes spawning shells/interpreters or making unexpected
// outbound connections — post-exploitation behavior following media parser compromise (CVE-2026-111183).
// Works with Syslog/CEF ingestion from Linux endpoints and Defender for Endpoint process telemetry.
let GstParents = dynamic(["gst-launch-1.0", "gst-play-1.0", "totem", "rhythmbox", "cheese", "pitivi", "kodi"]);
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat", "base64"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (GstParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIP
| sort by TimeGenerated desc;
// Companion: unexpected egress from media processes
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (GstParents)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize ConnectionCount = count(), Destinations = make_set(RemoteIP, 25) by DeviceName, InitiatingProcessFileName, RemotePort
| sort by ConnectionCount desc;
// Companion: crash telemetry referencing the vulnerable element (Syslog ingestion)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("rtpL16depay", "GstRtpL16Depay", "gstreamer")
   and SyslogMessage has_any ("segfault", "SIGSEGV", "heap", "core dumped", "abort")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

-- Artifact: Linux.Hunt.GStreamerExploitIndicators
-- Purpose: Identify GStreamer-linked processes with suspicious children, active RTP listeners,
-- and recently generated core dumps — triage for CVE-2026-111183 exploitation attempts.

-- 1) Running GStreamer-linked processes and their command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)gstreamer|gst-launch|rtpl16|rtpbin'
   OR Name =~ '(?i)gst-launch|totem|rhythmbox|kodi'

-- 2) Suspicious child processes of media applications
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|python3?|perl|curl|wget|nc|ncat|socat)$'

-- 3) UDP listeners in common RTP port ranges (5004/5005, 16384-32767)
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort in (5004, 5005)
   OR (LocalPort >= 16384 AND LocalPort <= 32767 AND Status =~ '(?i)listen|udp')

-- 4) Recent core dumps / crash artifacts for media processes
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/var/lib/apport/coredump/*', '/var/crash/*', '/var/lib/systemd/coredump/*'])
WHERE FullPath =~ '(?i)gst|totem|rhythmbox|kodi|media'
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-111183 — GStreamer rtpL16depay heap overflow: inventory, patch, verify
# Run as root on each Linux host. Review output before patching production media pipelines.

echo "=== [1] Installed GStreamer packages and versions ==="
if command -v dpkg >/dev/null 2>&1; then
    dpkg -l | grep -Ei 'gstreamer|gst-plugins' | awk '{print $1, $2, $3}'
elif command -v rpm >/dev/null 2>&1; then
    rpm -qa | grep -Ei 'gstreamer|gst-plugins' | sort
fi

echo "=== [2] Check for the vulnerable element (rtpL16depay) ==="
if command -v gst-inspect-1.0 >/dev/null 2>&1; then
    gst-inspect-1.0 rtpl16depay >/dev/null 2>&1 && echo "[!] rtpl16depay element PRESENT — host is potentially exposed"
    gst-inspect-1.0 --version | head -n1
else
    echo "[-] gst-inspect-1.0 not found on this host"
fi

echo "=== [3] Processes currently linked against GStreamer libraries ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
    if grep -qs 'libgstreamer\|libgstrtp' "/proc/$pid/maps" 2>/dev/null; then
        echo "PID $pid: $(cat /proc/$pid/comm 2>/dev/null)"
    fi
done

echo "=== [4] Apply vendor patches ==="
# Debian/Ubuntu:
# apt-get update && apt-get install --only-upgrade gstreamer1.0-plugins-good gstreamer1.0-plugins-base libgstreamer1.0-0
# RHEL/Fedora:
# dnf upgrade gstreamer1-plugins-good gstreamer1-plugins-base gstreamer1
# SUSE:
# zypper patch -t patch gstreamer-plugins-good

echo "=== [5] Post-patch verification — confirm package version matches vendor fixed release ==="
# dpkg -l gstreamer1.0-plugins-good   # or: rpm -q gstreamer1-plugins-good
# gst-inspect-1.0 --version

echo "=== [6] Recent crash artifacts referencing GStreamer (hunting) ==="
if command -v coredumpctl >/dev/null 2>&1; then
    coredumpctl list --no-pager 2>/dev/null | grep -Ei 'gst|totem|rhythmbox|media' | tail -n 20
fi
grep -Ei 'gstreamer|rtpL16' /var/log/syslog /var/log/messages 2>/dev/null | grep -Ei 'segfault|crash|abort' | tail -n 20