{"id":"CVE-2026-46471","kind":"vulnerability","aliases":["CVE-2026-46471"],"related":[],"title":"GStreamer gst-plugins-good: MP4 parsing can leak heap memory contents","description":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.","summary":"While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap buffer in GStreamer gst-plugins-good before 1.28.2. An attacker who supplies a crafted MP4 file can disclose heap memory contents.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gstreamer","linux","media-processing","package"],"not_affected_if":["no-untrusted-mp4-input"],"how_to_check":"- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager (for example `dpkg -l | grep gst-plugins-good`).\n- Find applications that decode MP4 files with GStreamer, such as media servers or thumbnailers, using `unknown` as the sources do not list them.","fix":"- Upgrade gst-plugins-good to `1.28.2` or later.\n- Rebuild or update applications that bundle GStreamer so they pick up the fixed plugin.","status":"open","published_at":"2026-10-16T16:18:11+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:14:10+00:00","updated_at":"2026-10-25T04:14:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade gst-plugins-good to `1.28.2` or later.\n- Rebuild or update applications that bundle GStreamer so they pick up the fixed plugin.","reach":"unknown","title":"GStreamer gst-plugins-good: MP4 parsing can leak heap memory contents","impact":"low","summary":"While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap buffer in GStreamer gst-plugins-good before 1.28.2. An attacker who supplies a crafted MP4 file can disclose heap memory contents.","category":"package","nicknames":[],"who_cares":["gstreamer","media-processing","linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads heap memory contents from the affected process.","analyst_note":"","how_to_check":"- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager (for example `dpkg -l | grep gst-plugins-good`).\n- Find applications that decode MP4 files with GStreamer, such as media servers or thumbnailers, using `unknown` as the sources do not list them.","needs_analyst":false,"not_affected_if":["no-untrusted-mp4-input"],"who_is_affected":"Systems that run GStreamer gst-plugins-good before `1.28.2` and use its isomp4 demuxer to parse MP4 files, especially when those files come from untrusted users or the internet. Systems that do not process untrusted MP4 input are lower risk. The sources do not list specific products or configurations.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3306,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-46471':15A,18A '1.28.2':54B,79C 'alloc':102C 'allow':104C 'attack':56B,106C 'buffer':46B,103C 'content':12A,67B,111C 'craft':60B 'cve':13A,16A 'disclos':64B,108C 'discov':71C 'end':42B,97C 'file':29B,62B,84C 'function':37B,92C 'good':5A,52B,77C 'gst':3A,50B,75C 'gst-plugins-good':2A,49B,74C 'gstreamer':1A,19B,48B,73C 'heap':10A,45B,65B,101C,109C 'heap-alloc':100C 'isomp4':31B,86C 'issu':69C 'leak':9A 'linux':20B 'may':38B,93C 'media':22B 'media-process':21B 'memori':11A,66B,110C 'mp4':6A,28B,61B,83C 'packag':24B 'pars':7A,26B,35B,81C,90C 'past':40B,95C 'plugin':4A,32B,51B,76C,87C 'process':23B 'qtdemux':34B,89C 'read':39B,94C 'suppli':58B 'uuid':36B,91C","nicknames":[],"mitigations":[],"who_affected":"Systems that run GStreamer gst-plugins-good before `1.28.2` and use its isomp4 demuxer to parse MP4 files, especially when those files come from untrusted users or the internet. Systems that do not process untrusted MP4 input are lower risk. The sources do not list specific products or configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46471","severity":null,"published_at":"2026-10-16T16:18:11+00:00","modified_at":"2026-10-19T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}