UBUNTU-CVE-2026-46470: Critical severity ubuntu/gst-plugins-good1.0 vulnerability
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemuxaudiocaps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.5+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.14.5-0ubuntu1~18.04.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.20.3-0ubuntu1.6 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.24.2-1ubuntu1.4 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.26.5-1ubuntu2.3
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The vulnerability is rated with local attack vector and requires no privileges or user interaction. Exploitation requires the affected software to parse a malicious MP4 audio track.
Which versions contain the fix?
The issue affects GStreamer gst-plugins-good versions before 1.28.2. Updating to 1.28.2 or later addresses the vulnerable atom-data validation.