Security Advisory 2026-0079 (CVE-2026-88914)
| Summary | Integer overflow and out-of-bounds read in MOV/MP4 demuxer closed caption parser |
| Date | 2026-09-07 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.7 |
| IDs | GStreamer-SA-2026-0079 CVE-2026-88914 |
Details
Two vulnerabilities in the CEA-608 closed caption parser of the MOV/MP4 demuxer (qtdemux) in gst-plugins-good. When parsing caption sample data containing multiple atoms, the bounds check for the second atom uses arithmetic that can overflow, allowing reads beyond the sample buffer. Additionally, the length parameter passed to the caption data conversion function is declared with an insufficiently narrow type, truncating larger values and causing out-of-bounds reads past the end of the caption sample buffer.
Impact
A malicious third party could trigger a heap out-of-bounds read by providing a crafted MP4 or MOV file with a CEA-608 closed caption track containing oversized atom declarations. This can result in application crash, denial of service, or information disclosure through leaked heap memory appearing in the downstream caption stream.
Solution
The gst-plugins-good 1.28.7 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.