CVE-2026-46472

7.5High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-125

Impact

Remote unauthenticated attackers can expose sensitive process memory by getting the service to parse a crafted MP4 file. This leads to information disclosure without requiring user interaction.

Root cause

The qtdemux_parse_chnl function in the isomp4 plugin performs an out-of-bounds read past the end of a global array during MP4 parsing.

Affected systems

GStreamer gst-plugins-good prior to version 1.28.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade gst-plugins-good to version 1.28.2 or newer. If you cannot upgrade immediately, block or filter untrusted MP4 ingestion in your processing pipeline.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade gstreamer1.0-plugins-good

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

References

https://gstreamer.freedesktop.org/security/sa-2026-0018.html

Source: nvd.nist.gov/vuln/detail/CVE-2026-46472