Gst Plugins Good
Monthly
Denial of service in GStreamer gst-plugins-good before 1.28.2 lets remote attackers crash media-processing pipelines that demux untrusted MP4/QuickTime content, because qtdemux_audio_caps in the isomp4 plugin performs a division on atom data it has not adequately validated, triggering an integer divide-by-zero. The supplied assessment confines impact to availability (C:N/I:N/A:H) and says affected deployments are players, thumbnailers, transcoders and streaming pipelines that actually process attacker-supplied media; environments that never feed untrusted MP4 input into the isomp4/qtdemux path are not exposed. No active exploitation or public exploit code is identified in the supplied data (EPSS 0.01%, SSVC exploitation:none), yet the vuln.today decision label is act_now, so the conflicting signals should be reconciled before prioritization.
GStreamer's gst-plugins-good FLV demuxer can be driven into an assertion failure or process crash by malformed or truncated FLV streams carrying enhanced audio/video tags, producing a denial of service in applications that open or stream the file. The assessed CVSS score is 6.5 with availability-only impact and UI:R, and affected deployments include gst-plugins-good plus Red Hat Enterprise Linux 7, 8, 9, and 10. No CISA KEV entry or public exploit code was identified in the supplied data, and the vuln.today priority label is this_month.
Integer division by zero in GStreamer gst-plugins-good before version 1.28.2 allows local attackers to cause denial of service by crafting malicious MP4 audio files. The isomp4 plugin's qtdemux_parse_trak function fails to validate atom data before performing division operations, causing application crash when parsing specially crafted audio tracks. No authentication required; exploitation requires only local file access and media playback.
Denial of service in GStreamer gst-plugins-good before 1.28.2 lets remote attackers crash media-processing pipelines that demux untrusted MP4/QuickTime content, because qtdemux_audio_caps in the isomp4 plugin performs a division on atom data it has not adequately validated, triggering an integer divide-by-zero. The supplied assessment confines impact to availability (C:N/I:N/A:H) and says affected deployments are players, thumbnailers, transcoders and streaming pipelines that actually process attacker-supplied media; environments that never feed untrusted MP4 input into the isomp4/qtdemux path are not exposed. No active exploitation or public exploit code is identified in the supplied data (EPSS 0.01%, SSVC exploitation:none), yet the vuln.today decision label is act_now, so the conflicting signals should be reconciled before prioritization.
GStreamer's gst-plugins-good FLV demuxer can be driven into an assertion failure or process crash by malformed or truncated FLV streams carrying enhanced audio/video tags, producing a denial of service in applications that open or stream the file. The assessed CVSS score is 6.5 with availability-only impact and UI:R, and affected deployments include gst-plugins-good plus Red Hat Enterprise Linux 7, 8, 9, and 10. No CISA KEV entry or public exploit code was identified in the supplied data, and the vuln.today priority label is this_month.
Integer division by zero in GStreamer gst-plugins-good before version 1.28.2 allows local attackers to cause denial of service by crafting malicious MP4 audio files. The isomp4 plugin's qtdemux_parse_trak function fails to validate atom data before performing division operations, causing application crash when parsing specially crafted audio tracks. No authentication required; exploitation requires only local file access and media playback.