GStreamer gst-plugins-good CVE-2026-46469

The vulnerability requires a locally accessible malicious MP4 audio file. Exploitation occurs when GStreamer's isomp4 plugin attempts to parse the audio track atoms in the file, specifically in the qtdemux_parse_trak function. The malformed atom must contain zero or missing values in fields that are used as divisors (e.g., sample rate, frame count, or time scale). No special GStreamer configuration or non-default settings are required-the default parser behavior is vulnerable. Exploitation is limited to local file access; remote exploitation would require the target system to parse a remotely-hosted MP4 file, which depends on application behavior (e.g., streaming media player, web-based media processing). User interaction is required to trigger parsing (opening/playing the file), but no authentication or elevated privileges are needed.

This vulnerability presents low-to-moderate real-world risk despite the local attack vector. CVSS 4.0 with AV:L/AC:L/PR:N/UI:N reflects local exploitation only, but the audio parsing context means exploitation requires user interaction (opening a crafted MP4 file) even though PR:N suggests no privilege escalation. The vulnerability does not affect confidentiality or integrity-only availability. EPSS data is absent, but this is a straightforward denial-of-service issue affecting a library that processes untrusted media files, making it a realistic attack against users who open MP4 files from untrusted sources (email, web downloads, messaging). The attack complexity is low (AC:L) and requires no special conditions beyond a malicious file, suggesting moderate exploitability. However, impact is limited to process crash, not code execution or system compromise. Organizations relying on GStreamer for audio transcoding, streaming, or desktop media playback should prioritize patching, particularly in automated processing pipelines where a crash could disrupt service.

An attacker crafts a malicious MP4 file with audio track atoms containing zero or missing values in fields used by qtdemux_parse_trak (such as sample count or timing divisors). When a user opens or plays the file in an application using GStreamer (e.g., GNOME Videos, Audacious, or a media server), the isomp4 plugin attempts to parse the track atoms, triggering integer division by zero, which crashes the application or the GStreamer daemon. The attacker could distribute the malicious file via email, file sharing sites, or media repositories to cause widespread denial of service.