# CVE-2026-46472: GStreamer gst-plugins-good out-of-bounds read in qtdemux_parse_chnl

Source: https://junglewise.ai/threats/cve-2026-46472-an-issue-was-discovered-in-gstreamer-gst-plugins-good-before-1-28  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-46472 · Severity: info · Published 2026-10-16

GStreamer is a multimedia framework used by media players and streaming applications to handle audio and video files. The isomp4 plugin, which parses MP4 files, contains a buffer over-read vulnerability when processing audio channel metadata that could expose sensitive memory contents when a malicious MP4 file is opened.

Technologies: [Gstreamer Gst-Plugins-Good](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-good). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-46472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46472 being exploited in the wild.

**How severe is CVE-2026-46472?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Good before 1.28.2.

**Is there a fix for CVE-2026-46472?** Yes: fixed in gst-plugins-good 1.28.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46472 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46472?** Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in gst-plugins-good 1.28.2

## Technical details

The qtdemux_parse_chnl function in the isomp4 plugin fails to properly validate the audio channel layout index when parsing MP4 chnl boxes, leading to an out-of-bounds read from a global array. This occurs during MP4 file parsing without requiring user authentication or special privileges. An attacker can craft a malicious MP4 file that, when parsed, leaks sensitive information from the application's memory.

## Affected products

- GStreamer gst-plugins-good before 1.28.2

## Timeline

- 2026-10-16: disclosed
- 2026-04-07: advisory: GStreamer Security Advisory 2026-0018 published

## References

- [https://gstreamer.freedesktop.org/security/sa-2026-0018.html](https://gstreamer.freedesktop.org/security/sa-2026-0018.html)

## Related threats

- [GStreamer gst-plugins-good out-of-bounds heap read in qtdemux](https://junglewise.ai/threats/cve-2026-125041-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-mov-mp4-demuxer)
- [GStreamer gst-plugins-good H.264 RTP depayloader heap read overflow](https://junglewise.ai/threats/cve-2026-119610-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-specifically-in)
- [GStreamer adaptive streaming demuxers local file disclosure via unvalidated URIs](https://junglewise.ai/threats/cve-2026-121629-a-flaw-was-found-in-gstreamer-s-adaptive-streaming-demuxers-hls)
- [GStreamer gst-plugins-good avidemux denial of service](https://junglewise.ai/threats/cve-2026-73473-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good integer overflow in AVI parser](https://junglewise.ai/threats/cve-2026-73472-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)