CVE-2026-46471

A flaw was found in gstreamer1-plugins-good. An out-of-bounds read vulnerability exists in the isomp4 plugin when parsing custom metadata in MP4 files. By tricking a user or service into processing a specially crafted MP4 file, a remote attacker could cause the application to read past the end of an allocated heap buffer, resulting in information disclosure of sensitive memory contents.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If multimedia playback and processing are not required, remove the package containing the affected plugin:

dnf remove gstreamer1-plugins-good

Caveat: Removing this package may prompt the removal of dependent desktop components or graphical media applications, potentially impacting the GNOME desktop environment. Verify package dependencies before proceeding. Headless server environments managed via terminal remain fully functional.

Additionally, apply operational controls by avoiding opening or processing untrusted MP4 files in applications that utilize the GStreamer framework.