CVE-2026-14935
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
Scoring
- Severity
- LOW
- CVSS base score
- 3.7
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.23%
- CWE
- CWE-670
- Published
- 2026-07-07
- Last modified
- 2026-07-08
Weakness type
Related vulnerabilities
- CVE-2026-55624 — MintyItanium Lost-Auction takes items like barrier blocks out from search GUI
- CVE-2026-72705 — Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
- CVE-2026-72704 — Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
- CVE-2026-72703 — Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
- CVE-2026-19487 — Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
- CVE-2026-73283 — In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be...
- CVE-2026-20713 — Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors...
- CVE-2026-56328 — Capgo - Integrity Issue in Release Routing via Multiple Public Channels