Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-88914 →

UBUNTU-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:20.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-0ubuntu1.3+esm4"}]}]

Ubuntu:22.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-0ubuntu1.10"}]}]

Ubuntu:24.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2-1ubuntu1.8"}]}]

Ubuntu:26.04:LTS gst-plugins-good1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-2ubuntu0.4"}]}]

Description d'origine

Paquets affectés

Références