Security Advisory 2026-0018 (CVE-2026-46469, CVE-2026-46470, CVE-2026-46472)
|
|
| Summary |
MOV/MP4 demuxer audio channel parsing vulnerabilities |
| Date |
2026-04-07 |
| Affected Versions |
GStreamer gst-plugins-good < 1.28.2 |
| IDs |
GStreamer-SA-2026-0018
CVE-2026-46469, CVE-2026-46470, CVE-2026-46472 |
Details
Multiple vulnerabilities in the MOV/MP4 demuxer's audio channel layout parsing
code when handling chan and chnl boxes. The issues include out-of-bounds
reads and writes when the number of audio channels exceeds 63, an out-of-bounds
array access when using an invalid defined layout index, and a division by zero
when zero audio channels are signalled.
Impact
It is possible for a malicious third party to trigger out-of-bounds memory
accesses or a division by zero that result in a crash of the application. In
case of out-of-bounds reads, this may also allow information disclosure.
Solution
The gst-plugins-good 1.28.2 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.28 (current stable)
Patches
