CVE-2026-46471: Medium severity GStreamer gst-plugins-good vulnerability
Published Oct 16, 2026
·Updated
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
Affected Software
6 affected components
GStreamer gst-plugins-good<1.28.2
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
Event History
Oct 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·04:18 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What input must an attacker control to exploit this issue?
An attacker needs to supply an MP4 file that is parsed by the isomp4 plugin. The vulnerable code path is qtdemux_parse_uuid.
2
What is the impact of successful exploitation?
Successful exploitation may disclose contents of heap memory because the parser can read beyond the end of a heap-allocated buffer.
3
Which versions should be remediated?
GStreamer gst-plugins-good versions before 1.28.2 are affected. Upgrade to 1.28.2 or later.