{"id":"CVE-2026-88914","aliases":["DEBIAN-CVE-2026-88914","EUVD-2026-75905","GHSA-h8hr-49hh-qr69","UBUNTU-CVE-2026-88914","USN-8863-1"],"status":"published","title":"Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00121,"percentile":0.01942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-09-11T01:48:43Z","modified":"2026-11-06T02:17:55Z","fixes":[{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.28.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.16.3-0ubuntu1.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.20.3-0ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.24.2-1ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","fixed_in":["1.28.2-2ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u4"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1","1.22.0-5+deb12u2","1.22.0-5+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.2-1+deb13u1","1.26.2-1+deb13u2","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1","1.28.7-1","1.28.8-1","1.29.1-1","1.29.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.7-1"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1","1.28.1-1","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.4-1","1.28.5-1","1.28.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3","1.16.3-0ubuntu1.3+esm1","1.16.3-0ubuntu1.3+esm2","1.16.3-0ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6","1.20.3-0ubuntu1.7","1.20.3-0ubuntu1.8","1.20.3-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4","1.24.2-1ubuntu1.5","1.24.2-1ubuntu1.6","1.24.2-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2","1.28.2-2ubuntu0.1","1.28.2-2ubuntu0.2","1.28.2-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.5+esm4"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.2-1ubuntu1","1.7.90-1ubuntu1","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.2-1ubuntu0.3","1.8.3-1ubuntu0.3","1.8.3-1ubuntu0.4","1.8.3-1ubuntu0.5","1.8.3-1ubuntu0.5+esm1","1.8.3-1ubuntu0.5+esm2","1.8.3-1ubuntu0.5+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-0ubuntu1~18.04.3+esm4"}]}],"versions":["1.12.3-1ubuntu1","1.12.4-1ubuntu1","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.2","1.14.5-0ubuntu1~18.04.3","1.14.5-0ubuntu1~18.04.3+esm1","1.14.5-0ubuntu1~18.04.3+esm2","1.14.5-0ubuntu1~18.04.3+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}],"versions":["1.16.1-1ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu2.1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.2","1.16.3-0ubuntu1.3","1.16.3-0ubuntu1.3+esm1","1.16.3-0ubuntu1.3+esm2","1.16.3-0ubuntu1.3+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}],"versions":["1.18.5-1ubuntu2","1.18.5-1ubuntu3","1.20.0-2ubuntu1","1.20.1-1ubuntu1","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.3","1.20.3-0ubuntu1.4","1.20.3-0ubuntu1.5","1.20.3-0ubuntu1.6","1.20.3-0ubuntu1.7","1.20.3-0ubuntu1.8","1.20.3-0ubuntu1.9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}],"versions":["1.22.6-1ubuntu1","1.22.6-1ubuntu2","1.22.8-3ubuntu1","1.22.9-1ubuntu1","1.24.0-1ubuntu5","1.24.0-1ubuntu7","1.24.1-2ubuntu1","1.24.2-1ubuntu1","1.24.2-1ubuntu1.1","1.24.2-1ubuntu1.2","1.24.2-1ubuntu1.3","1.24.2-1ubuntu1.4","1.24.2-1ubuntu1.5","1.24.2-1ubuntu1.6","1.24.2-1ubuntu1.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}],"versions":["1.26.5-1ubuntu2","1.27.2-1ubuntu1","1.27.90-1ubuntu1","1.28.0-1ubuntu1","1.28.0-1ubuntu3","1.28.1-1ubuntu1","1.28.2-2","1.28.2-2ubuntu0.1","1.28.2-2ubuntu0.2","1.28.2-2ubuntu0.3"],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88914","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531416","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12433","tags":["report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0079.html","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88914"},{"url":"https://github.com/advisories/GHSA-h8hr-49hh-qr69"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88914","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88914","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5235","tags":["report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12437","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8863-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-17072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73434","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-88914","title":"Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T01:48:43.886Z","modified":"2026-11-06T01:13:34.87Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-75905","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T01:48:43Z","modified":"2026-11-06T01:13:34Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-h8hr-49hh-qr69","title":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially...","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T03:30:22Z","modified":"2026-09-11T03:30:23Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:11:43.788148Z"}],"nvd":[{"id":"CVE-2026-88914","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T02:18:35.3Z","modified":"2026-11-06T02:17:55.23Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"DEBIAN-CVE-2026-88914","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T02:18:35.3Z","modified":"2026-10-15T17:47:53.042823667Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"UBUNTU-CVE-2026-88914","description":"A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.","status":"published","published":"2026-09-11T02:18:00Z","modified":"2026-10-02T05:45:09.497944381Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"USN-8863-1","title":"gst-plugins-good1.0 vulnerabilities","description":"Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled\ncertain FLAC audio streams. An attacker could possibly use this issue to\nobtain sensitive information. (CVE-2026-17072)\n\nSeonwook Kim discovered that GStreamer Good Plugins incorrectly parsed\ncertain AVI files. An attacker could possibly use this issue to cause a\ndenial of service or obtain sensitive information. (CVE-2026-73433)\n\nSeonwook Kim discovered that GStreamer Good Plugins did not correctly parse\ncertain AVI files. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-73434)\n\nSeonwook Kim discovered that GStreamer Good Plugins incorrectly handled\ncertain closed caption data. An attacker could possibly use this issue to\nobtain sensitive information. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-88914)","status":"published","published":"2026-10-01T16:46:33Z","modified":"2026-10-02T05:57:29.444899723Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}