CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

This vulnerability is rated as Moderate because exploitation requires a user to open a crafted MP4 or MOV file and the issue is limited to an out-of-bounds read of up to approximately 244 bytes of adjacent heap memory. Code execution is not possible from this read-only flaw. Red Hat product impact analysis is pending component mapping to determine which products ship the affected gst-plugins-good qtdemux CEA-608 caption parsing code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.