Integer Overflow Vulnerability in GStreamer's isomp4 Plugin

CVE-2026-88914

What is CVE-2026-88914?

A critical flaw has been identified in the isomp4 plugin of GStreamer's gst-plugins-good package. This vulnerability arises when handling specially crafted MP4 or MOV files that contain CEA-608 closed-caption data. An integer overflow in 32-bit unsigned arithmetic may occur, allowing the bounds check to be bypassed in the caption parser. This error can result in an out-of-bounds heap read of up to 244 bytes. An attacker could exploit this vulnerability by convincing a user to open a malicious media file, which may lead to the disclosure of sensitive adjacent heap memory or even crash the application.

References