CVE-2026-46470

MEDIUM 4 ALL-YEARS

Published 2026-05-14 · Last modified 2026-05-14 · mitre · NVD: Analyzed

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 11th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

4CVSS 3.1 · MEDIUM · CNA

ConfidentialityNone
IntegrityNone
AvailabilityLow

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Gstreamer Freedesktop

Products Good Plug Ins Gst Plugins Good

Weakness (CWE)

CWE-369: Divide By Zero

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References and research data (JSON)

Known Affected Software Configurations

Vendor	Product	Version range
Freedesktop	Gst Plugins Good	< 1.28.2

All CVSS metrics

MEDIUM 4 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
MEDIUM 4 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CRITICAL 9.1 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Patches & mitigations

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243.patch PatchCVE record · mitre · Updated 2026-05-14T18:05:13.714Z
NVD · CVE-2026-46470 · Updated 2026-06-17T10:53:41.610

Advisories

https://gstreamer.freedesktop.org/security/sa-2026-0018.html Vendor AdvisoryCVE record · mitre · Updated 2026-05-14T18:05:13.714Z
NVD · CVE-2026-46470 · Updated 2026-06-17T10:53:41.610
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30350 ADVISORYEUVD · EUVD-2026-30350

Sources: NVD · CVE.org · All sources and attribution · EPSS