CVE-2026-46471: n/a
Description
A vulnerability in GStreamer's gst-plugins-good before version 1.28.2 allows the isomp4 plugin's qtdemux_parse_uuid function to read beyond the end of a heap buffer when parsing MP4 files. This can lead to disclosure of heap memory contents to an attacker.
Affected software
pkg:github/gstreamer/gst-plugins-goodRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46471 describes a heap buffer over-read in the isomp4 plugin of GStreamer's gst-plugins-good component prior to version 1.28.2. The vulnerability occurs during MP4 file parsing in the qtdemux_parse_uuid function, which may read past the allocated heap buffer boundary. This flaw can potentially allow an attacker to obtain sensitive information from heap memory.
Potential Impact
An attacker who can supply a crafted MP4 file to the vulnerable GStreamer component may be able to read unintended heap memory contents, leading to potential information disclosure. There is no indication of code execution or denial of service from the provided data.
Mitigation Recommendations
Upgrade to GStreamer gst-plugins-good version 1.28.2 or later, where this issue is fixed. Patch status is confirmed by the version boundary provided. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-14T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6ad24b622cdf04f656070136
Added to database: 10/16/2026, 16:05:54 UTC
Last enriched: 10/16/2026, 16:18:43 UTC
Last updated: 10/17/2026, 02:48:08 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.