PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46472 GStreamer CVE debrief

CVE-2026-46472 is an issue discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure. This vulnerability is classified as an information disclosure issue, which may allow out-of-bounds reads when parsing MP4 files. The affected product is GStreamer gst-plugins-good, and defenders should prioritize verifying versions and assessing exposure.

Vendor
GStreamer
Product
gst-plugins-good
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-16
Advisory published
2026-10-16
Advisory updated
2026-10-16

Who should care

Defenders responsible for GStreamer gst-plugins-good deployments, particularly those using versions before 1.28.2, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-46472 is an information disclosure vulnerability in GStreamer gst-plugins-good, potentially allowing out-of-bounds reads when parsing MP4 files. Defenders should prioritize verifying versions and assessing exposure.

  • Information disclosure may occur due to out-of-bounds reads in the qtdemux_parse_chnl function.
  • Defenders should verify GStreamer gst-plugins-good versions to determine exposure.
  • Remediation priority is moderate, as the vulnerability is limited to information disclosure.

Technical summary

The qtdemux_parse_chnl function in the isomp4 plugin of GStreamer gst-plugins-good may read past the end of a global array when parsing an MP4 file. This vulnerability is related to information disclosure and may allow out-of-bounds reads. The affected product is GStreamer gst-plugins-good before version 1.28.2. Defenders should prioritize verifying the versions of GStreamer gst-plugins-good in use and assessing exposure to MP4 file parsing.

Defensive priority

Defenders should prioritize verifying the versions of GStreamer gst-plugins-good in use and assessing exposure to MP4 file parsing.

Recommended defensive actions

  • Verify GStreamer gst-plugins-good versions in use
  • Assess exposure to MP4 file parsing
  • Review and update affected systems

Evidence notes

The CVE record and source item provide limited information about the vulnerability, including its potential impact on information disclosure. The vulnerability is related to the qtdemux_parse_chnl function in the isomp4 plugin of GStreamer gst-plugins-good. The source confidence is limited, and defenders should verify the versions of GStreamer gst-plugins-good in use and assess exposure to MP4 file parsing. The CVE Program record and NVD detail page provide additional information about

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46472 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46472

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46472 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46472

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-46472

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46472.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gstreamer.freedesktop.org/security/sa-2026-0018.html

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.