CVE-2026-46472

A flaw was found in gstreamer1-plugins-good. When processing a crafted MP4 media file, the isomp4 plugin's qtdemux_parse_chnl function can read past the boundary of a global array. A remote attacker could exploit this vulnerability by enticing a user or service to process a specially crafted file, potentially leading to unauthorized information disclosure.

This vulnerability is rated as Low severity because successful exploitation requires user interaction to open a malicious media file and only results in an out-of-bounds read of adjacent memory, without causing system crashes or enabling arbitrary code execution. In Red Hat Enterprise Linux environments, GStreamer plugins are typically invoked by interactive desktop applications or local media pipelines rather than unauthenticated network services. Consequently, exposure is limited to local or user-assisted contexts where an attacker must trick an individual into processing an untrusted video file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On systems where multimedia playback and demuxing are not required, remove the package to eliminate exposure:

dnf remove gstreamer1-plugins-good

Caveat: Removing gstreamer1-plugins-good may uninstall dependent graphical desktop packages (such as GNOME components) or break media playback in applications relying on the GStreamer framework. Headless server environments remain fully functional via terminal access.

For systems that must parse media files, do not open untrusted MP4 files and isolate media handling pipelines within unprivileged containers or sandboxes.