CVE-2026-46470 is a division by zero in the GStreamer gst-plugins-good MP4 demuxer, scored CVSS 4.0 in the NVD record. A crafted MP4 can crash an application that parses it. The fix ships in gst-plugins-good 1.28.2, so upgrade to that release or later.
What's affected
The NVD record and GStreamer security advisory SA-2026-0018 say gst-plugins-good before 1.28.2 is affected. The fixed version is 1.28.2. The vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so the impact is a limited loss of availability.
The same advisory also covers CVE-2026-46469 and CVE-2026-46472, other flaws in the same audio channel parsing code.
How to check if you're exposed
- Run
gst-inspect-1.0 --versionto see the GStreamer version, thengst-inspect-1.0 isomp4to confirm the plugin and its version. - On Debian or Ubuntu,
dpkg -l | grep gstreamer1.0-plugins-goodshows the package version. On Fedora or RHEL, userpm -q gstreamer1-plugins-good. - Check applications that bundle their own GStreamer, such as media players and thumbnailers, because the system package may not cover them.
Distributions often backport fixes without changing the version number, so check your vendor's security notice if your version looks old.
What to do now
- Update gst-plugins-good to 1.28.2 or later through your package manager.
- If you cannot upgrade, the advisory says you can apply the patch from GStreamer merge request 11243 and rebuild.
- Restart long running services that use GStreamer so they load the new library.
- Be careful with media from untrusted sources in server side pipelines, such as thumbnail jobs.
Why it matters
The weakness is CWE-369, divide by zero. The record says the parser does not validate atom data enough before dividing, so a file that signals zero audio channels can crash the process. The advisory describes the impact as a crash.
For a desktop player that is an annoyance. For a service that processes uploads, a crash on demand can be a real availability problem. The KEV flag is false.
Quick check
Can this lead to code execution?
The record describes only denial of service. The related CVEs in the same advisory mention out of bounds access, so check the advisory if you want the full picture.
Sources
Last reviewed: 19 October 2026.
