CVE-2026-5056

A stack-based buffer overflow in GStreamer's qtdemux component allows attackers to execute arbitrary code via specially crafted input. This occurs due to insufficient data length validation when parsing UncompressedFrameConfigBox structures.

An Important security flaw in GStreamer's QuickTime parser could allow an attacker to execute malicious code if a user opens a specially crafted media file. Because the vulnerable code was introduced in GStreamer 1.26.0, Red Hat Enterprise Linux (RHEL) versions 9 and older do not contain this code and are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not open, preview, or auto-index untrusted MOV/MP4 files with GStreamer-based apps; leave RHEL memory protections and SELinux enabled