Security Advisory 2026-0050

Details

Heap buffer overflow vulnerabilities in the qtmoovrecover element (MOV/MP4 moov recovery tool) in gst-plugins-good when parsing recovery files. The file parser trusts atom size fields from the input without validating they meet minimum expected sizes, and performs size calculations that can truncate larger values. A crafted recovery file with undersized atom declarations causes heap buffers to be allocated that are too small, and subsequent writes of atom fields overflow past the allocation boundary.

Impact

A malicious third party could trigger a heap buffer overflow by providing a crafted MRF file to the moov recovery tool, potentially resulting in data corruption, crash, denial of service, or arbitrary code execution. The qtmoovrecover element is a utility component that requires explicit user invocation with specific input files, limiting the attack surface compared to elements used in standard media playback pipelines.

Solution

The gst-plugins-good 1.28.5 release addresses the issue by validating box sizes during MRF file parsing to ensure all atoms meet their minimum expected sizes and that container atoms properly contain their sub-atoms.

People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch