CVE-2026-46470

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.

The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via invalid memory reads, leading to crashes.

The gst_avi_demux_parse_ncdt function in gst-plugins-good in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.

The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.

In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_parse_trak function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.