GStreamer isomp4 CVE-2026-88914

The target must open a specially crafted MP4 or MOV file that contains a CEA-608 closed-caption track with maliciously constructed size fields. The file must be processed by an application that uses GStreamer's gst-plugins-good isomp4 plugin with CEA-608 caption parsing enabled - this is a default capability of gst-plugins-good and requires no non-default configuration. Exploitation is limited by the requirement for user interaction (UI:R): the victim must actively open the malicious file. Additionally, the attacker must have a mechanism to observe the disclosed heap bytes (e.g., via caption output displayed or logged), which may not be straightforward in all deployment contexts. The integer overflow is in 32-bit arithmetic, so the specific trigger may be architecture-sensitive. No authentication or elevated privileges are required.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) correctly places this in the moderate range at 4.4. The local attack vector reflects that the malicious file must be opened in a GStreamer-consuming application by the victim, and user interaction is required - both factors that substantially reduce mass-exploitation risk compared to network-reachable flaws. The confidentiality impact is rated Low because only up to 244 bytes of adjacent heap are disclosed, which may or may not contain sensitive data depending on heap layout and application state. The availability impact is Low, reflecting crash potential rather than persistent denial of service. No EPSS score was provided in the input data, and the vulnerability is not listed in the CISA KEV catalog. No public proof-of-concept exploit has been identified. While exploiting this in a targeted scenario (e.g., to leak function pointers or credential material from a media-handling service) requires favorable heap layout, even a mid-sized municipal IT team in gliwice should treat this as low-urgency but worth patching given GStreamer's presence in desktop Linux environments. SSVC assessment: exploitation is theoretical (no known exploit chain), automatable only with social engineering, and technical impact is partial - consistent with the low CVSS score.

An attacker crafts a malicious MP4 or MOV file containing a CEA-608 caption track with carefully computed size values that trigger the 32-bit integer overflow in the isomp4 caption parser. The attacker delivers the file to a target via email attachment, web download, or messaging application. When the victim opens the file in a media player or application backed by GStreamer (e.g., GNOME Videos, Rhythmbox, or a web browser using GStreamer), the parser reads up to 244 bytes of adjacent heap memory and passes it into the caption output stream, potentially exposing heap pointers, string data, or cryptographic material to the attacker if they control where caption output is sent.