CVE-2026-46471
UnknownSummary
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
Risk Assessment
An attacker can exploit a specially crafted MP4 file to disclose heap memory contents of the process. This may lead to leakage of sensitive data, including pointers and other information.
Recommendation
Update gst-plugins-good to version 1.28.2 or later. Avoid processing untrusted MP4 files until the update is applied.
Other vulnerabilities in GStreamer gst-plugins-good
See all- CVE-2026-46472High
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
- CVE-2017-5845High
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via invalid memory reads, leading to crashes.
- CVE-2017-5841High
The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.
- CVE-2016-10199High
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
- CVE-2026-18649High
In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.
Original NVD description (English source)
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS