PT-2026-41013 · Gstreamer+2 · Gst-Plugins-Good+2

Published 2026-05-14 · Updated 2026-05-28 · CVE-2026-46470

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-good versions prior to 1.28.2

Description An issue exists when parsing MP4 audio tracks where the isomp4 plugin's qtdemux audio caps() function fails to sufficiently validate atom data before performing division operations. This can result in a denial of service caused by an integer division by zero.

Recommendations Update to version 1.28.2 or later.

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CVE-2026-46470

ECHO-C7AB-A86E-DBB9

USN-8317-1

Affected Products

Linuxmint

Ubuntu

Gst-Plugins-Good

References · 14

• https://cve.org/CVERecord?id=CVE-2026-46470 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46470 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46470 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46469 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8317-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46470 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46470 · Vendor Advisory
• https://gstreamer.freedesktop.org/security/sa-2026-0018.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8317-1 · Vendor Advisory
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243.patch · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46470 · Vendor Advisory
• https://reddit.com/r/linuxmint/comments/1tpxegb/psa_usn_alerts_for_libcaca_gstreamer_ubuntu · Reddit Post
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243 · Note
• https://t.me/cveNotify/164043 · Telegram Post