Live › vulnerability › CVE-2026-46471
Go to dashboardWhile parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap buffer in GStreamer gst-plugins-good before 1.28.2. An attacker who supplies a crafted MP4 file can disclose heap memory contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run GStreamer gst-plugins-good before and use its isomp4 demuxer to parse MP4 files, especially when those files come from untrusted users or the internet. Systems that do not process untrusted MP4 input are lower risk. The sources do not list specific products or configurations.
1.28.2No product ranges from the sources yet.
gst-inspect-1.0 --version or your package manager (for example dpkg -l | grep gst-plugins-good).unknown as the sources do not list them.1.28.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-46471")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.