Executive brief
GStreamer is a widely used multimedia framework for processing audio and video. A vulnerability in its MP4 file handling component allows a specially crafted audio file to crash applications using the library. This results in a denial-of-service condition where the software becomes unresponsive or terminates unexpectedly when attempting to play or process a malicious file.
Technical details
A division-by-zero vulnerability exists in the GStreamer 'isomp4' plugin within the 'qtdemux_audio_caps' function. When parsing MP4 (MOV) files, the demuxer fails to sufficiently validate atom data, specifically allowing a value of zero for the number of audio channels. This leads to an integer division by zero during internal calculations (such as bytes-per-sample or bytes-per-frame derivation). An attacker can exploit this by providing a malformed MP4 file, causing the application to crash. The issue is fixed in version 1.28.2 by adding explicit checks for 'n_channels > 0' before performing division. Related issues in the same patch set also addressed out-of-bounds reads/writes in 'chan' and 'chnl' box parsing.
Affected products
- GStreamer gst-plugins-good < 1.28.2
Timeline
- 2026-03-19: patched: Initial patches submitted to GitLab.
- 2026-04-07: advisory: GStreamer project security advisory published.
- 2026-05-14: disclosed: CVE published to NVD.