{"id":"CVE-2026-46472","kind":"vulnerability","aliases":["CVE-2026-46472"],"related":[],"title":"GStreamer gst-plugins-good: MP4 parser may read past array end","description":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.","summary":"GStreamer's gst-plugins-good isomp4 plugin, in function qtdemux_parse_chnl, can read past the end of a global array while parsing an MP4 file. The likely result is information disclosure from process memory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gstreamer","linux","media-pipelines","package"],"not_affected_if":["no-mp4-parsing"],"how_to_check":"- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager (for example `dpkg -l | grep gst-plugins-good`).\n- Confirm whether the isomp4 demuxer is in use, for example `gst-inspect-1.0 isomp4`.","fix":"- Upgrade gst-plugins-good to `1.28.2` or later.","status":"open","published_at":"2026-10-16T16:18:11+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:25:02+00:00","updated_at":"2026-10-25T03:25:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:25:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade gst-plugins-good to `1.28.2` or later.","reach":"unknown","title":"GStreamer gst-plugins-good: MP4 parser may read past array end","impact":"low","summary":"GStreamer's gst-plugins-good isomp4 plugin, in function qtdemux_parse_chnl, can read past the end of a global array while parsing an MP4 file. The likely result is information disclosure from process memory.","category":"package","nicknames":[],"who_cares":["gstreamer","media-pipelines","linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads process memory via crafted MP4 file","analyst_note":"","how_to_check":"- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager (for example `dpkg -l | grep gst-plugins-good`).\n- Confirm whether the isomp4 demuxer is in use, for example `gst-inspect-1.0 isomp4`.","needs_analyst":false,"not_affected_if":["no-mp4-parsing"],"who_is_affected":"Applications that use GStreamer to demux MP4 files, including media players, transcoders and pipelines that accept user-supplied video. Systems that never open MP4 files through GStreamer can skip it. The sources do not say which distributions or default configurations ship the affected version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000588,"input_tokens":3292,"output_tokens":518,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-46472':15A,18A '1.28.2':72C 'array':11A,46B,94C 'chnl':37B,84C 'cve':13A,16A 'disclosur':57B,99C 'discov':64C 'end':12A,42B,90C 'file':51B,77C 'function':34B,85C 'global':45B,93C 'good':5A,30B,70C 'gst':3A,28B,68C 'gst-plugins-good':2A,27B,67C 'gstreamer':1A,19B,25B,66C 'inform':56B,98C 'isomp4':31B,79C 'issu':62C 'lead':96C 'like':53B 'linux':20B 'may':8A,86C 'media':22B 'media-pipelin':21B 'memori':60B 'mp4':6A,50B,76C 'packag':24B 'pars':36B,48B,74C,83C 'parser':7A 'past':10A,40B,88C 'pipelin':23B 'plugin':4A,29B,32B,69C,80C 'potenti':95C 'process':59B 'qtdemux':35B,82C 'read':9A,39B,87C 'result':54B","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer to demux MP4 files, including media players, transcoders and pipelines that accept user-supplied video. Systems that never open MP4 files through GStreamer can skip it. The sources do not say which distributions or default configurations ship the affected version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46472","severity":null,"published_at":"2026-10-16T16:18:11+00:00","modified_at":"2026-10-16T19:55:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}