This vulnerability involves a heap buffer over-read in the qtdemux_parse_trak function of the isomp4 plugin in GStreamer through version 1.26.1. When parsing a crafted MP4 file, the function may read past the allocated heap buffer boundary, resulting in potential information disclosure. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, affecting confidentiality, integrity, and availability. The weakness corresponds to CWE-125 (Out-of-bounds Read). No patch or official fix has been documented yet.

Successful exploitation could allow an attacker to read sensitive memory contents beyond the intended buffer, leading to information disclosure. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding processing untrusted MP4 files with vulnerable versions of GStreamer. Monitor vendor communications for updates on patches or mitigations.