{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-125041","cwes":["CWE-1284"],"description":"A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794248212377,"publishedAt":1794248212377,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-125041"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569126"},{"source":"CNA: redhat","tags":[],"url":"https://gstreamer.freedesktop.org/security/sa-2026-0025.html"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Update gst-plugins-good to version 1.28.3 or later. Where updating is not yet possible, avoid processing untrusted MOV/MP4 files with qtdemux; deployments that do not need MOV/MP4 support can disable the isomp4 plugin."}],"revision":"be641487edd407e3f9dd380471e7117af51c5d109feb7e1b85e9de6494abd414","sources":[{"modifiedAt":1794248212377,"name":"CNA: redhat","retrievedAt":1794251347134,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125041"}],"ssvc":null,"status":"published","title":"Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout","updatedAt":1794251347134}