Executive brief
GStreamer is a widely used multimedia framework for processing audio and video. A vulnerability in its MP4 and MOV file processing component allows a specially crafted media file to crash applications using the library. This could lead to a denial of service, impacting the reliability of media players, web browsers, or streaming services that rely on GStreamer to handle audio tracks.
Technical details
Multiple vulnerabilities exist in the GStreamer 'isomp4' plugin within the 'qtdemux_parse_trak' and 'qtdemux_parse_chnl' functions. The root cause is insufficient validation of atom data in MP4/MOV files, specifically when handling 'chan' and 'chnl' boxes. An attacker can provide a crafted file with zero audio channels to trigger an integer division by zero, or specify more than 63 channels/invalid layout indices to trigger out-of-bounds reads and writes. These issues can lead to application crashes (DoS) or potential information disclosure via out-of-bounds reads. The vulnerability is addressed in GStreamer gst-plugins-good version 1.28.2.
Affected products
- GStreamer gst-plugins-good < 1.28.2
Timeline
- 2026-03-19: other: Internal patches authored
- 2026-04-07: advisory: Vendor security advisory SA-2026-0018 published
- 2026-05-14: disclosed: CVE published to NVD