# CVE-2026-125041: GStreamer gst-plugins-good out-of-bounds heap read in qtdemux

Source: https://junglewise.ai/threats/cve-2026-125041-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-mov-mp4-demuxer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-125041 · Severity: medium · CVSS 5.5 · Published 2026-11-09

GStreamer's MOV/MP4 video processing component (qtdemux) fails to properly validate video layout parameters in crafted media files. An attacker can exploit this flaw by providing a malicious MOV/MP4 file that causes the application to read from invalid memory locations, crashing the application and denying service to users.

Technologies: [Gstreamer Gst-Plugins-Good](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-good). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-125041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125041 being exploited in the wild.

**How severe is CVE-2026-125041?** Medium severity, with a CVSS score of 5.5, published 9 November 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Good before 1.28.3.

**Is there a fix for CVE-2026-125041?** Yes: fixed in gst-plugins-good 1.28.3. Until then: Avoid processing untrusted MOV/MP4 files with qtdemux; deployments that do not require MOV/MP4 support can disable the isomp4 plugin. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125041 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-125041?** Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in gst-plugins-good 1.28.3

Avoid processing untrusted MOV/MP4 files with qtdemux; deployments that do not require MOV/MP4 support can disable the isomp4 plugin.

## Technical details

The qtdemux demuxer in gst-plugins-good fails to validate row alignment and chroma geometry declarations before constructing video buffer layouts for uncompressed video tracks. A crafted MOV/MP4 file with malformed layout parameters triggers an out-of-bounds heap read during sample copying, potentially crashing the process. Exploitation requires local file access and user interaction to open the malicious media file.

## Affected products

- GStreamer gst-plugins-good before 1.28.3

## Timeline

- 2026-11-09: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-125041](https://access.redhat.com/security/cve/CVE-2026-125041)

## Related threats

- [GStreamer gst-plugins-good H.264 RTP depayloader heap read overflow](https://junglewise.ai/threats/cve-2026-119610-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-specifically-in)
- [GStreamer adaptive streaming demuxers local file disclosure via unvalidated URIs](https://junglewise.ai/threats/cve-2026-121629-a-flaw-was-found-in-gstreamer-s-adaptive-streaming-demuxers-hls)
- [GStreamer gst-plugins-good avidemux denial of service](https://junglewise.ai/threats/cve-2026-73473-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good integer overflow in AVI parser](https://junglewise.ai/threats/cve-2026-73472-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good out-of-bounds read in Nikon metadata parser](https://junglewise.ai/threats/cve-2026-73471-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)