CVE-2026-46470

9.1 Critique

Publiée le 14/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:53 · Analysée par le NVD · Source : cve@mitre.org

Description

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

Traduire en français

Produits concernés

GStreamer Good Plug-ins
Freedesktop gst-plugins-good

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.0 Moyenne	cve@mitre.org	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
3.1	9.1 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`

Faiblesses (CWE)

CWE-369

Références

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243.patch Patch
https://gstreamer.freedesktop.org/security/sa-2026-0018.html Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories