Executive brief
GStreamer is a widely-used multimedia framework that processes audio and video files. The qtmoovrecover tool within GStreamer contains a vulnerability in how it parses recovery files (.MRF) used for MOV/MP4 repair. An attacker can craft a malicious recovery file that, when processed by this utility, can trigger arbitrary code execution on the system.
Technical details
A heap buffer overflow exists in the qtmoovrecover element (MOV/MP4 moov recovery tool) within gst-plugins-good when parsing recovery files. The vulnerability stems from insufficient validation of atom size fields in MRF files; the parser trusts declared atom sizes without checking minimum expected sizes, leading to undersized heap buffer allocations. When subsequent atom field writes occur, they overflow past the allocation boundary. Exploitation requires user interaction (opening a malicious .MRF file) and invocation of the qtmoovrecover utility, limiting exposure. An attacker can achieve heap corruption, denial of service, or arbitrary code execution. GStreamer 1.28.5 and later versions include fixes that validate box sizes during parsing.
Affected products
- GStreamer gst-plugins-good < 1.28.5
Timeline
- 2026-05-20: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: Coordinated public release of advisory
- 2026-08-20: patched: GStreamer 1.28.5 release published