Is CVE-2026-121625 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121625?

CVE-2026-121625 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-121625

Description

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.