Security Advisory 2026-0016 (CVE-2026-5056, ZDI-CAN-29392)
| Summary | Integer overflows and out-of-bounds access in MOV/MP4 demuxer |
| Date | 2026-04-07 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.2 |
| IDs | GStreamer-SA-2026-0016 CVE-2026-5056 ZDI-CAN-29392 |
Details
Integer overflows and out-of-bounds access vulnerabilities in the qtdemux element (MOV/MP4 demuxer) in gst-plugins-good when handling malformed MOV/MP4 files with uncompressed video. The vulnerabilities occur in the parsing of cmpd, cpat, and uncC atoms, where insufficient validation of component counts, pattern dimensions, and component indices allows integer overflows during size calculations and out-of-bounds array access.
Impact
A malicious third party could trigger a crash in the application, resulting in denial of service, or possibly execute arbitrary code when processing malicious MOV/MP4 media files.
Solution
The gst-plugins-good 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.