Denial of Service Risk in GStreamer Audio Processing by Vendor GStreamer

CVE-2026-46470

What is CVE-2026-46470?

A flaw in the GStreamer gst-plugins-good package allows maliciously crafted MP4 audio tracks to trigger failures during parsing. Specifically, the isomp4 plugin’s qtdemux_audio_caps function lacks proper validation of atom data, creating a risk of denial of service through integer division by zero operations. This security hole affects versions prior to 1.28.2, necessitating prompt updates to safeguard against potential attacks.

References