REDHAT-BUG-2531416: Medium severity GStreamer gst-plugins-good vulnerability
GStreamer gst-plugins-good contains a vulnerability in the MOV/MP4 demuxer (qtdemux) closed-caption parser. In the extractccfromdata() function in subprojects/gst-plugins-good/gst/isomp4/qtdemux.c, when parsing a CEA-608 caption sample containing two atoms (cdat/cdt2), the bounds check for the second atom at line 6426 computes 'atomlength + newatomlength' using 32-bit unsigned arithmetic (both are guint32). An attacker can craft the second atom's length (newatomlength) such that this addition wraps around to a small value, bypassing the bounds check. The value 'newatomlength - 8' is then passed to converttos3341a() as a guint8 parameter (ccpairsize), truncating a large 32-bit value to at most 244 bytes. This causes converttos3341a() to read up to 244 bytes beyond the valid caption sample buffer, and the out-of-bounds heap data is included in the downstream caption output stream. Versions prior to gst-plugins-good 1.28.7 are affected. Fixed in gst-plugins-good 1.28.7. Security Advisory: GStreamer-SA-2026-0079. Upstream MR: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/mergerequests/12433. Reported by Seonwook Kim. PSIRT ticket: PSIRTSUPT-23503.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-goodto a version that resolves this vulnerability.Fixed in 1.28.7 - Compensating control
If upgrading is not immediately possible, mitigate by blocking or restricting processing of untrusted MOV/MP4 files (qtdemux closed-caption parser / CEA-608 caption samples) at the ingestion point until gst-plugins-good 1.28.7 is deployed.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted CEA-608 closed-caption sample containing cdat/cdt2 atoms to the qtdemux MOV/MP4 demuxer. The second atom length must be chosen to trigger a 32-bit unsigned integer wraparound.
What information could be exposed?
The flaw can cause qtdemux to read up to 244 bytes beyond the valid caption sample buffer. That out-of-bounds heap data is included in the downstream caption output stream, creating an information disclosure risk.
Which versions need remediation?
Versions of gst-plugins-good before 1.28.7 are affected. The issue is fixed in gst-plugins-good 1.28.7.
What can be done if upgrading is not immediately possible?
Avoid processing untrusted MOV/MP4 content that may contain CEA-608 closed-caption samples with cdat/cdt2 atoms. This reduces exposure to attacker-controlled caption parsing until the fixed version can be deployed.