CVE-2026-125041: Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout
Published Nov 9, 2026
·Updated
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.
Other sources
GStreamer-SA-2026-0025: Insufficient validation in MOV/MP4 demuxer uncompressed video handling. Advisory details and affected version range were not available from the page fetch; the OSIM record is based on the published advisory title and date.
— Red Hat
Affected Software
1 affected component
GStreamer gst-plugins-good
Event History
Nov 9, 2026
Data Sourced
via Red Hat·12:56 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·06:16 PM
Data Sourced
via MITRE·06:16 PM
DescriptionSeverityWeakness