GStreamer gst-plugins-good EUVD-2026-30350

Exploitation requires the target to parse an attacker-supplied MP4/QuickTime file whose audio track atoms are crafted so that unvalidated atom fields produce a zero denominator in the isomp4 plugin's qtdemux_audio_caps function; any application built on gst-plugins-good before 1.28.2 that demuxes untrusted media (players, thumbnailers, transcoders, streaming pipelines) is affected. Limiting factors: impact is confined to a crash of the GStreamer process (no code execution, no data disclosure per the description), and the host application must actually feed untrusted media through the isomp4/qtdemux path - environments that never process attacker-controlled MP4 input are not exposed.

Signals conflict sharply and must be reconciled before prioritizing. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H = 9.1) rates confidentiality impact as High, but the description characterizes the flaw purely as a denial of service from an integer division by zero in qtdemux_audio_caps - there is no stated information disclosure, so the C:H metric appears inflated and the true impact is availability-only (independently assessed 7.5). EPSS is 0.01% (2nd percentile) and the CISA SSVC framing is Exploitation: none, Automatable: no, Technical Impact: partial, all pointing to low real-world exploitation pressure, yet the vuln.today priority is labelled act_now; this tension suggests the act_now label is driven by the inflated CVSS and the broad deployment of GStreamer rather than by observed exploitation. Net assessment: a genuine, patch-worthy availability bug in widely deployed media-parsing code, but a crash-only DoS - not a confidentiality breach and not an actively exploited emergency. No public exploit was identified in the provided data (the GitLab .patch reference is the fix, not exploit code). Priority is real for environments that parse untrusted media, but the raw 9.1 overstates the technical impact.

An attacker supplies a malformed MP4 file whose audio track atoms contain values that drive a denominator to zero inside qtdemux_audio_caps; when a GStreamer-based application (media player, transcoder, or automated media pipeline) demuxes the file via the isomp4 plugin, the division-by-zero crashes the process, denying service. No public exploit code was identified at time of analysis, and because the vector is network-reachable with low complexity, any workflow that ingests attacker-controlled media is exposed.