UBUNTU-CVE-2026-46471: Medium severity ubuntu/gst-plugins-good1.0 vulnerability
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.5+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.14.5-0ubuntu1~18.04.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.20.3-0ubuntu1.11
Event History
Frequently Asked Questions
Which systems are exposed?
Systems using gst-plugins-good versions before 1.28.2 are affected when the isomp4 plugin parses MP4 content. Exposure is most relevant where untrusted or attacker-supplied MP4 files may be opened or processed.
What does an attacker need to exploit this issue?
An attacker needs to provide a specially crafted MP4 file that reaches the isomp4 plugin's qtdemux_parse_uuid function. The reported vector is local and requires user interaction, but does not require attacker privileges.
What is the security impact of successful exploitation?
Successful exploitation can disclose contents of heap memory through an out-of-bounds read. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.
How can I determine whether my installation needs attention?
Check the installed gst-plugins-good version and identify whether it is earlier than 1.28.2. Also identify applications or workflows that parse MP4 files using the affected GStreamer plugin.