Security Advisory 2026-0025

Details

Insufficient validation of stride requirements and width/height constraints for uncompressed video streams in the MOV/MP4 demuxer (qtdemux). The demuxer did not validate that the row alignment size met minimum stride requirements for the given video format, nor did it check that width and height values were compatible with the chroma subsampling format (4:2:0, 4:2:2, 4:1:1).

This affected all uncompressed video profiles supported by the uncC (Uncompressed Video) box in MOV/MP4 files.

Impact

A malicious third party could trigger a crash or denial of service by providing a crafted MOV/MP4 file with invalid uncompressed video parameters.

Solution

The gst-plugins-good 1.28.3 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.3 release

• Release Notes
• GStreamer Plugins Good 1.28.3

Patches

• Patch