# CVE-2026-46471: GStreamer gst-plugins-good heap buffer over-read in MP4 demuxer

Source: https://junglewise.ai/threats/cve-2026-46471-an-issue-was-discovered-in-gstreamer-gst-plugins-good-before-1-28  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-46471 · Severity: info · Published 2026-10-16

GStreamer is a multimedia framework used for audio and video playback in many applications and Linux distributions. A flaw in its MP4 file parser allows specially crafted media files to read beyond allocated memory, potentially exposing sensitive data from the application's memory.

Technologies: [Gstreamer Gst-Plugins-Good](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-good). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-46471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46471 being exploited in the wild.

**How severe is CVE-2026-46471?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Good before 1.28.1.

**Is there a fix for CVE-2026-46471?** Yes: fixed in gst-plugins-good 1.28.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46471 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-46471?** Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in gst-plugins-good 1.28.1

## Technical details

An out-of-bounds read vulnerability exists in the isomp4 plugin's qtdemux_parse_uuid function when handling specially crafted PlayReady DRM MP4 files. The vulnerability allows reading past the end of a heap-allocated buffer via a network or local file, requiring user interaction (opening a malicious file) but no authentication. An attacker gains the ability to disclose heap memory contents or trigger an application crash.

## Affected products

- GStreamer gst-plugins-good before 1.28.1

## Timeline

- 2026-02-25: disclosed
- 2026-02-26: patched
- 2026-05-07: advisory
- 2026-10-16: other: CVE published via NVD

## References

- [https://github.com/atredispartners/advisories/blob/master/2026/ATREDIS-2026-0004.md](https://github.com/atredispartners/advisories/blob/master/2026/ATREDIS-2026-0004.md)
- [https://gstreamer.freedesktop.org/security/sa-2026-0002.html](https://gstreamer.freedesktop.org/security/sa-2026-0002.html)

## Related threats

- [GStreamer gst-plugins-good out-of-bounds heap read in qtdemux](https://junglewise.ai/threats/cve-2026-125041-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-mov-mp4-demuxer)
- [GStreamer gst-plugins-good H.264 RTP depayloader heap read overflow](https://junglewise.ai/threats/cve-2026-119610-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-specifically-in)
- [GStreamer adaptive streaming demuxers local file disclosure via unvalidated URIs](https://junglewise.ai/threats/cve-2026-121629-a-flaw-was-found-in-gstreamer-s-adaptive-streaming-demuxers-hls)
- [GStreamer gst-plugins-good avidemux denial of service](https://junglewise.ai/threats/cve-2026-73473-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good integer overflow in AVI parser](https://junglewise.ai/threats/cve-2026-73472-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)