CVE-2026-88914 Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
An integer overflow in GStreamer's CEA-608 parser allows attackers to read adjacent heap memory or crash the application via a malicious media file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-88914?
CVE-2026-88914 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 11 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.
Weakness: CWE-190
Which versions are affected by CVE-2026-88914?
How do I fix CVE-2026-88914?
Apply the vendor's patch.
Is CVE-2026-88914 being exploited?
There is no known exploitation of CVE-2026-88914 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-88914, ECHO-a9c1-c7b1-8672, GHSA-h8hr-49hh-qr69, UBUNTU-CVE-2026-88914.