{
  "threat_severity" : "Moderate",
  "public_date" : "2026-10-16T00:00:00Z",
  "bugzilla" : {
    "description" : "gstreamer1-plugins-good: gstreamer1-plugins-good: information disclosure via out-of-bounds read during MP4 parsing",
    "id" : "2554180",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2554180"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-125",
  "details" : [ "An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.", "A flaw was found in gstreamer1-plugins-good. An out-of-bounds read vulnerability exists in the isomp4 plugin when parsing custom metadata in MP4 files. By tricking a user or service into processing a specially crafted MP4 file, a remote attacker could cause the application to read past the end of an allocated heap buffer, resulting in information disclosure of sensitive memory contents." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "gstreamer1-plugins-good",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "gstreamer1-plugins-good",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "gstreamer1-plugins-good",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "gstreamer1-plugins-good",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46471\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46471\nhttps://github.com/atredispartners/advisories/blob/master/2026/ATREDIS-2026-0004.md\nhttps://gstreamer.freedesktop.org/security/sa-2026-0002.html" ],
  "name" : "CVE-2026-46471",
  "mitigation" : {
    "value" : "If multimedia playback and processing are not required, remove the package containing the affected plugin:\n# dnf remove gstreamer1-plugins-good\nCaveat: Removing this package may prompt the removal of dependent desktop components or graphical media applications, potentially impacting the GNOME desktop environment. Verify package dependencies before proceeding. Headless server environments managed via terminal remain fully functional.\nAdditionally, apply operational controls by avoiding opening or processing untrusted MP4 files in applications that utilize the GStreamer framework.",
    "lang" : "en:us"
  },
  "csaw" : false
}