Is CVE-2026-46471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46471 being exploited in the wild.

How severe is CVE-2026-46471?

Informational severity, published 16 October 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Good before 1.28.1.

Is there a fix for CVE-2026-46471?

Yes: fixed in gst-plugins-good 1.28.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46471 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-46471?

Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46471: GStreamer gst-plugins-good heap buffer over-read in MP4 demuxer

CVE-2026-46471 · Severity: info · Published 2026-10-16

GStreamer is a multimedia framework used for audio and video playback in many applications and Linux distributions. A flaw in its MP4 file parser allows specially crafted media files to read beyond allocated memory, potentially exposing sensitive data from the application's memory.

Technologies: Gstreamer Gst-Plugins-Good. Vendors: Gstreamer.

Quick answers

Is CVE-2026-46471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46471 being exploited in the wild.
How severe is CVE-2026-46471?: Informational severity, published 16 October 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Good before 1.28.1.
Is there a fix for CVE-2026-46471?: Yes: fixed in gst-plugins-good 1.28.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46471 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-46471?: Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: gst-plugins-good 1.28.1

Technical details

An out-of-bounds read vulnerability exists in the isomp4 plugin's qtdemux_parse_uuid function when handling specially crafted PlayReady DRM MP4 files. The vulnerability allows reading past the end of a heap-allocated buffer via a network or local file, requiring user interaction (opening a malicious file) but no authentication. An attacker gains the ability to disclose heap memory contents or trigger an application crash.

Affected products

GStreamer gst-plugins-good before 1.28.1

Timeline

2026-02-25: disclosed
2026-02-26: patched
2026-05-07: advisory
2026-10-16: other: CVE published via NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.