CVE-2026-121625

Low

Description

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

SeverityLow

CVSS3.7

Exploit probability—

ProductWillamowius Gnugk

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

willamowius gnugk5.16 or later

Patches

github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777

Vendor advisories

github.com/willamowius/gnugk/releases/tag/v5_16

Affected products

Product	Affected versions	Fixed in
willamowius gnugk	v < 5.16	5.16

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.