CVE-2026-88914: Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.
Other sources
GStreamer gst-plugins-good contains a vulnerability in the MOV/MP4 demuxer (qtdemux) closed-caption parser. In the extractccfromdata() function in subprojects/gst-plugins-good/gst/isomp4/qtdemux.c, when parsing a CEA-608 caption sample containing two atoms (cdat/cdt2), the bounds check for the second atom at line 6426 computes 'atomlength + newatomlength' using 32-bit unsigned arithmetic (both are guint32). An attacker can craft the second atom's length (newatomlength) such that this addition wraps around to a small value, bypassing the bounds check. The value 'newatomlength - 8' is then passed to converttos3341a() as a guint8 parameter (ccpairsize), truncating a large 32-bit value to at most 244 bytes. This causes converttos3341a() to read up to 244 bytes beyond the valid caption sample buffer, and the out-of-bounds heap data is included in the downstream caption output stream. Versions prior to gst-plugins-good 1.28.7 are affected. Fixed in gst-plugins-good 1.28.7. Security Advisory: GStreamer-SA-2026-0079. Upstream MR: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/mergerequests/12433. Reported by Seonwook Kim. PSIRT ticket: PSIRTSUPT-23503.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gstreamer/gst-plugins-good (gst-plugins-good isomp4 qtmux/qtdemux CEA-608 parser)to a version that resolves this vulnerability.Fixed in 1.28.7Patch GStreamer-SA-2026-0079 - Upgrade
Upgrade
gstreamer/gst-plugins-good (gst-plugins-good isomp4 plugin)to a version that resolves this vulnerability.Fixed in 1.28.7Patch PSIRTSUPT-23503
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using GStreamer's gst-plugins-good MOV/MP4 demuxer (qtdemux) are exposed when they process attacker-controlled MP4 or MOV files containing CEA-608 closed-caption data. Exploitation requires a user to open the crafted media file.
What can exploitation cause?
The integer overflow can bypass a caption-parser bounds check and cause an out-of-bounds heap read of up to 244 bytes. The read data may be included in downstream caption output, potentially disclosing adjacent heap memory or crashing the application.
What conditions must the malicious file meet?
The file must contain a CEA-608 caption sample with two atoms, cdat or cdt2. The attacker crafts the second atom length so that a 32-bit unsigned addition wraps around and bypasses the bounds check.