An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (CVE-2026-46471)
Description
A vulnerability in GStreamer gst-plugins-good before version 1.28.2 allows an attacker to disclose heap memory contents. The issue occurs in the isomp4 plugin's qtdemux_parse_uuid function when parsing MP4 files, due to reading past the end of a heap-allocated buffer.
Affected software
pkg:github/gstreamer/gst-plugins-goodRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46471 describes a vulnerability in the GStreamer gst-plugins-good package prior to version 1.28.2. The issue arises in the isomp4 plugin's qtdemux_parse_uuid function during MP4 file parsing, where a heap buffer overflow allows reading beyond the allocated memory. This can result in an attacker disclosing contents of heap memory, potentially leaking sensitive information.
Potential Impact
The vulnerability allows an attacker to disclose contents of heap memory by exploiting a buffer over-read during MP4 file parsing. This could lead to information leakage but does not indicate direct code execution or system compromise based on the provided data.
Mitigation Recommendations
A fix is available in GStreamer gst-plugins-good version 1.28.2. Users should upgrade to version 1.28.2 or later to remediate this vulnerability. No additional mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5vvw-9383-fwx7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-46471"]
- State
- PUBLISHED
Threat ID: 6ad2af0c2cdf04f656455cf8
Added to database: 10/16/2026, 23:11:08 UTC
Last enriched: 10/16/2026, 23:19:41 UTC
Last updated: 10/17/2026, 03:48:08 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.