CVE-2026-46472: High severity GStreamer gst-plugins-good vulnerability
Published Oct 16, 2026
·Updated
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure.
Affected Software
7 affected componentsFixes available
GStreamer gst-plugins-good<1.28.2
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
ubuntu/gst-plugins-good1.0*
alpine/gst-plugins-good<1.26.3-r0
1.26.3-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/gst-plugins-goodto a version that resolves this vulnerability.Fixed in 1.26.3-r0
Event History
Oct 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·04:18 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Nov 4, 2026
Withdrawn
via OSV·12:32 AM
Frequently Asked Questions
1
What input must an attacker control to trigger this issue?
An attacker would need to supply a crafted MP4 file that reaches the isomp4 plugin's qtdemux_parse_chnl parsing function.
2
What is the potential security impact?
The out-of-bounds read may lead to information disclosure.
3
Which versions are affected?
GStreamer gst-plugins-good versions before 1.28.2 are affected.