CVE-2026-125041 · Runtime
NO FIX YET
GStreamer's gst-plugins-good MOV/MP4 demuxer (qtdemux) does not validate row alignment and chroma geometry for uncompressed video tracks. A crafted file can cause an out-of-bounds heap read that may crash the application, a denial of service.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use GStreamer with the gst-plugins-good qtdemux element to open MOV or MP4 files, especially those that accept files from untrusted sources. Systems that never parse media from outside sources are less exposed. The sources do not name affected versions.
Not affected if no-untrusted-media
Who cares gst-plugins-good, gstreamer, media-pipeline
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.