Live › vulnerability › CVE-2026-46472
Go to dashboardGStreamer's gst-plugins-good isomp4 plugin, in function qtdemux_parse_chnl, can read past the end of a global array while parsing an MP4 file. The likely result is information disclosure from process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use GStreamer to demux MP4 files, including media players, transcoders and pipelines that accept user-supplied video. Systems that never open MP4 files through GStreamer can skip it. The sources do not say which distributions or default configurations ship the affected version.
No product ranges from the sources yet.
gst-inspect-1.0 --version or your package manager (for example dpkg -l | grep gst-plugins-good).gst-inspect-1.0 isomp4.1.28.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-46472")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.