In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | — | Feb 24, 2026 | Feb 24, 2026 |
| Alpine Linux | — | Upgrade gstreamerUpgrade gst-plugins-good | Aug 8, 2025 | Aug 7, 2025 |
| Amazon Linux Ami 2 | — | Upgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-gtk-debuginfo | Sep 16, 2025 | Aug 7, 2025 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 17 installer 17.63.12 (JDK 17.0.17.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.91.0.12 (JDK 8u481-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.85.12 (JDK 11.0.29.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.31.14 (JDK 25.0.1.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.47.14 (JDK 21.0.9.0.101+1, quarterly CPU) (LTS stream) | Feb 25, 2026 | Aug 7, 2025 |
| Debian | — | Upgrade gst-plugins-good1.0 | Sep 8, 2025 | Sep 8, 2025 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Aug 7, 2025 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Feb 3, 2026 | Aug 7, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 7, 2025 |
| Suse | — | Upgrade gstreamer-plugins-goodUpgrade gstreamer-plugins-good-jack-32bitUpgrade gstreamer-plugins-good-langUpgrade gstreamer-plugins-good-gtkUpgrade gstreamer-plugins-good-jackUpgrade gstreamer-plugins-good-qtqmlUpgrade gstreamer-plugins-good-32bitUpgrade gstreamer-plugins-good-extraUpgrade gstreamer-plugins-good-extra-32bit | Dec 5, 2025 | Jun 20, 2025 |
| Ubuntu | — | Upgrade gstreamer1.0-gtk3 (Ubuntu Pro)Upgrade libgstreamer-plugins-good1.0-0Upgrade gstreamer1.0-plugins-goodUpgrade gstreamer1.0-pulseaudio (Ubuntu Pro)Upgrade gstreamer1.0-qt6Upgrade gstreamer1.0-qt5Upgrade gstreamer1.0-gtk3Upgrade gstreamer1.0-qt5 (Ubuntu Pro)Upgrade gstreamer1.0-plugins-good (Ubuntu Pro)Upgrade libgstreamer-plugins-good1.0-0 (Ubuntu Pro)Upgrade gstreamer1.0-pulseaudio | Aug 27, 2025 | Aug 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub