Executive brief
GStreamer is a multimedia framework used to build applications that handle audio and video playback, streaming, and transcoding. The qtmoovrecover utility component contains a heap buffer overflow when parsing recovery files, allowing an attacker to achieve arbitrary code execution if a user opens a crafted malicious file. This could lead to complete system compromise or data theft.
Technical details
The vulnerability is a heap buffer overflow in the qtmoovrecover element (MOV/MP4 moov recovery tool) of gst-plugins-good during parsing of MRF (recovery) files. The root cause is insufficient validation of atom size fields in the file parser, combined with size calculations that can truncate larger values, resulting in undersized heap buffer allocations. When parsing a crafted MRF file with malformed atom declarations, subsequent writes overflow the heap buffer boundary. The attack requires user interaction (opening a malicious file), and the component is a utility rather than part of standard playback pipelines, limiting exposure. An attacker can achieve code execution, denial of service, or data corruption. The vulnerability is patched in gst-plugins-good 1.28.5 and later.
Affected products
- GStreamer gst-plugins-good < 1.28.5
Timeline
- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: Public advisory released (ZDI-26-464)
- 2026-07-08: patched: Fix available in gst-plugins-good 1.28.5