Buffer Overflow Vulnerability in GStreamer Plugins
CVE-2026-46471

5.5MEDIUM

Key Information:

Vendor

GStreamer

Status
gst-plugins-good
Vendor
CVE Published:
16 October 2026

What is CVE-2026-46471?

A vulnerability has been identified in GStreamer’s gst-plugins-good prior to version 1.28.2, where the isomp4 plugin's qtdemux_parse_uuid function can improperly handle certain MP4 file parsing operations. This oversight may lead to reading beyond the end of a heap-allocated buffer, potentially allowing an attacker to access sensitive heap memory contents, thus exposing critical information stored in memory.

References

https://gstreamer.freedesktop.org/security/sa-2026-0002.html
https://github.com/atredispartners/advisories/blob/master...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.