Security Advisory 2026-0016 (CVE-2026-5056, ZDI-CAN-29392)

Details

Integer overflows and out-of-bounds access vulnerabilities in the qtdemux element (MOV/MP4 demuxer) in gst-plugins-good when handling malformed MOV/MP4 files with uncompressed video. The vulnerabilities occur in the parsing of cmpd, cpat, and uncC atoms, where insufficient validation of component counts, pattern dimensions, and component indices allows integer overflows during size calculations and out-of-bounds array access.

Impact

A malicious third party could trigger a crash in the application, resulting in denial of service, or possibly execute arbitrary code when processing malicious MOV/MP4 media files.

Solution

The gst-plugins-good 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-5056

GStreamer 1.28.2 release

• Release Notes
• GStreamer Plugins Good 1.28.2

Patches

• Patch