This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-88914 →

UBUNTU-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption...

Original description

The description as published by the source.

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:20.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}]

Ubuntu:22.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}]

Ubuntu:24.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}]

Ubuntu:26.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}]

Original description

Affected packages

References