In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gst-plugins-goodUpgrade gstreamer | Aug 8, 2025 | Aug 7, 2025 |
| Amazon Linux Ami 2 | — | Upgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debuginfo | Sep 16, 2025 | Aug 7, 2025 |
| Debian | — | Upgrade gst-plugins-good1.0 | Dec 29, 2025 | Dec 29, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 7, 2025 |
| Suse | — | Upgrade gstreamer-plugins-good-extra-32bitUpgrade gstreamer-plugins-good-32bitUpgrade gstreamer-plugins-good-jackUpgrade gstreamer-plugins-good-extraUpgrade gstreamer-plugins-good-jack-32bitUpgrade gstreamer-plugins-good-qtqmlUpgrade gstreamer-plugins-goodUpgrade gstreamer-plugins-good-langUpgrade gstreamer-plugins-good-gtk | Dec 5, 2025 | Jun 20, 2025 |
| Ubuntu | — | Upgrade gstreamer1.0-qt6Upgrade gstreamer1.0-pulseaudioUpgrade libgstreamer-plugins-good1.0-0Upgrade gstreamer1.0-plugins-goodUpgrade gstreamer1.0-qt5Upgrade gstreamer1.0-gtk3 | Aug 27, 2025 | Aug 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub