What’s Vulnerable › Vulnerabilities

CVE-2026-14935: Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-07-08
• Weakness: CWE-670

Description

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 6: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-14935
• https://bugzilla.redhat.com/show_bug.cgi?id=2497679
• https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/98
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5171

Get alerted when CVE-2026-14935 or the next vulnerability affects your stack