CVE-2026-46472 Information disclosure in n/a
An out-of-bounds read in GStreamer's MP4 parser allows attackers to disclose sensitive information via a crafted file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46472?
CVE-2026-46472 is a high-severity vulnerability in n/a, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
Weakness: CWE-125
Which versions are affected by CVE-2026-46472?
How do I fix CVE-2026-46472?
Upgrade to a fixed version.
Is CVE-2026-46472 being exploited?
There is no known exploitation of CVE-2026-46472 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-46472, GHSA-2ffj-5jpx-7428, UBUNTU-CVE-2026-46472.