UBUNTU-CVE-2026-125041: Medium severity ubuntu/gst-plugins-good1.0 vulnerability
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Ubuntu's gst-plugins-good1.0 MOV/MP4 demuxer are exposed when they process a crafted MOV or MP4 file containing an uncompressed video track.
What does an attacker need to exploit it?
An attacker needs to induce the application to process a crafted media file. The listed vector indicates local access, no privileges, and user interaction are required.
What is the likely impact?
The crafted file can trigger an out-of-bounds heap read during sample copying, potentially crashing the application and causing denial of service.