{"id":"CVE-2026-125041","kind":"vulnerability","aliases":["CVE-2026-125041"],"related":[],"title":"GStreamer: crafted MOV/MP4 file triggers out-of-bounds heap read","description":"A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.","summary":"GStreamer's gst-plugins-good MOV/MP4 demuxer (qtdemux) does not validate row alignment and chroma geometry for uncompressed video tracks. A crafted file can cause an out-of-bounds heap read that may crash the application, a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-good","gstreamer","media-pipeline","runtime"],"not_affected_if":["no-untrusted-media"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","triaged_at":"2026-11-09T19:32:09+00:00","updated_at":"2026-11-09T19:32:09+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T19:32:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer: crafted MOV/MP4 file triggers out-of-bounds heap read","impact":"low","summary":"GStreamer's gst-plugins-good MOV/MP4 demuxer (qtdemux) does not validate row alignment and chroma geometry for uncompressed video tracks. A crafted file can cause an out-of-bounds heap read that may crash the application, a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gstreamer","gst-plugins-good","media-pipeline"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"application crashes from a crafted file, denial of service","analyst_note":"Find affected and fixed gst-plugins-good versions and the upstream fix commit from the NVD entry or GStreamer advisories; the sources given do not state them.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-media"],"who_is_affected":"Applications that use GStreamer with the gst-plugins-good qtdemux element to open MOV or MP4 files, especially those that accept files from untrusted sources. Systems that never parse media from outside sources are less exposed. The sources do not name affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4575,"output_tokens":497,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125041':14A,17A '-2026':13A,16A 'align':40B,95C 'applic':64B,128C 'bound':9A,57B,117C 'buffer':106C 'build':103C 'caus':52B,112C,130C 'chroma':42B,97C 'copi':124C 'craft':2A,49B,109C 'crash':62B,126C 'cve':12A,15A 'declar':93C 'demux':34B,81C 'denial':66B,131C 'fail':89C 'file':4A,50B,110C 'flaw':70C 'found':72C 'geometri':43B,98C 'good':21B,32B,79C 'gst':19B,30B,77C 'gst-plugins-good':18B,29B,76C 'gstreamer':1A,22B,27B,74C 'heap':10A,58B,118C 'layout':107C 'may':61B 'media':24B 'media-pipelin':23B 'mov/mp4':3A,33B,80C 'out-of-bound':6A,54B,114C 'pipelin':25B 'plugin':20B,31B,78C 'potenti':125C 'process':83C 'qtdemux':35B,88C 'read':11A,59B,119C 'row':39B,94C 'runtim':26B 'sampl':122C 'servic':68B,133C 'track':47B,87C 'trigger':5A 'uncompress':45B,85C 'use':100C 'valid':38B,91C 'video':46B,86C,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer with the gst-plugins-good qtdemux element to open MOV or MP4 files, especially those that accept files from untrusted sources. Systems that never parse media from outside sources are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsgood","gstreamer","mediapipeline","medium","runtime"],"campaign_type":null,"search_a":"'-125041':14A,17A '-2026':13A,16A 'bound':9A 'craft':2A 'cve':12A,15A 'file':4A 'gstreamer':1A 'heap':10A 'mov/mp4':3A 'out-of-bound':6A 'read':11A 'trigger':5A","search_b":"'align':40B 'applic':64B 'bound':57B 'caus':52B 'chroma':42B 'craft':49B 'crash':62B 'demux':34B 'denial':66B 'file':50B 'geometri':43B 'good':21B,32B 'gst':19B,30B 'gst-plugins-good':18B,29B 'gstreamer':22B,27B 'heap':58B 'may':61B 'media':24B 'media-pipelin':23B 'mov/mp4':33B 'out-of-bound':54B 'pipelin':25B 'plugin':20B,31B 'qtdemux':35B 'read':59B 'row':39B 'runtim':26B 'servic':68B 'track':47B 'uncompress':45B 'valid':38B 'video':46B","search_c":"'align':95C 'applic':128C 'bound':117C 'buffer':106C 'build':103C 'caus':112C,130C 'chroma':97C 'copi':124C 'craft':109C 'crash':126C 'declar':93C 'demux':81C 'denial':131C 'fail':89C 'file':110C 'flaw':70C 'found':72C 'geometri':98C 'good':79C 'gst':77C 'gst-plugins-good':76C 'gstreamer':74C 'heap':118C 'layout':107C 'mov/mp4':80C 'out-of-bound':114C 'plugin':78C 'potenti':125C 'process':83C 'qtdemux':88C 'read':119C 'row':94C 'sampl':122C 'servic':133C 'track':87C 'uncompress':85C 'use':100C 'valid':91C 'video':86C,105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125041","severity":null,"published_at":"2026-11-09T19:16:48+00:00","modified_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:15+00:00","fetched_at":"2026-11-09T19:28:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}