GStreamer gst-plugins-good EUVD-2026-102936

Exploitation requires an attacker-supplied MP4/QuickTime file containing a malformed 'uuid' atom that is parsed by the isomp4 plugin's qtdemux_parse_uuid function in GStreamer gst-plugins-good prior to 1.28.2. The limiting factor is user interaction (UI:R): a victim must open, play, or otherwise load the crafted file in a GStreamer-based application (e.g., media player, thumbnail/metadata extractor, or embedded media pipeline); there is no authentication requirement (PR:N) but also no remote-service exposure. Impact is bounded to heap memory disclosure (C:H, I:N, A:N) - no code execution or crash is claimed. Deployments on versions 1.28.2 or later are not affected.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) describes an information-disclosure-only flaw: it reads out of bounds (CWE-126 buffer over-read) to leak heap memory but has no integrity or availability impact and achieves no code execution. The AV:L combined with UI:R is consistent with a file-parsing bug - the 'local' vector reflects that an attacker must get a victim to open/load a crafted MP4 rather than exploiting it over a listening network service, so it behaves like a client-side social-engineering issue. All corroborating signals point to low real-world urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing (not actively exploited per available data), and no SSVC decision data was supplied. No public exploit was identified in the provided references (an Atredis Partners advisory and the GStreamer security advisory are discoverer/vendor writeups, which are distinct from weaponized exploit code). The main caveat: C:H for a bounded over-read is on the higher end - the practical value depends on whether leaked heap bytes surface to the attacker or aid ASLR defeat; raw severity alone overstates priority given info-disclosure-only impact and required user interaction.

An attacker crafts an MP4 file with a malformed 'uuid' box and delivers it via email, a website, or a download; when a victim opens or auto-processes it in any GStreamer-backed application (media player, file-manager thumbnailer, browser media pipeline), qtdemux_parse_uuid reads past the end of a heap buffer and leaks adjacent heap memory, which may expose sensitive data or help defeat ASLR. No public exploit code was identified at time of analysis; a discoverer advisory from Atredis Partners and a vendor advisory exist. Exploitation requires user interaction to load the file (UI:R) and yields disclosure only, not code execution.