Heap Buffer Overflow in GStreamer gst-plugins-good MP4 Parsing

Executive Summary

CVE-2026-46471 is a heap out-of-bounds read vulnerability in the GStreamer multimedia framework. It occurs in the qtdemux_parse_uuid function of the gst-plugins-good package when parsing an MP4 file encrypted with PlayReady DRM. The function fails to validate the size of the UUID atom before reading data, leading to potential buffer overreads that allow disclosure of heap memory contents.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of GStreamer gst-plugins-good installed on your system. If it is below 1.28.2, the system is vulnerable. Use commands like 'gst-inspect-1.0 --version' to check the version. Monitor GStreamer error logs for crashes or memory leaks when processing MP4 files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to disclose heap memory contents, bypass ASLR by leaking memory addresses, or access sensitive information like file contents (e.g., /etc/passwd). Exploitation requires a crafted MP4 file and could lead to information disclosure or further system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized disclosure of sensitive data. An attacker may exploit the heap out-of-bounds read to access heap memory contents, which could include sensitive information such as user credentials or file contents. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GStreamer gst-plugins-good to version 1.28.2 or later. If updating is not possible, apply the patch provided for older releases. Avoid processing untrusted MP4 files, especially those encrypted with PlayReady DRM, until the update is applied.

Useful 0 Not Useful 0