MEDIUM 5.5 NVD
CVE-2026-125041
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignm
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.
References
- https://access.redhat.com/security/cve/CVE-2026-125041
- https://bugzilla.redhat.com/show_bug.cgi?id=2569126
- https://gstreamer.freedesktop.org/security/sa-2026-0025.html
This medium severity vulnerability with a CVSS score of 5.5 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.