Vulnerability · Published May 14, 2026 · Assigned by mitre
CVE-2026-46470
Medium 4.0
In plain English
A medium-severity security flaw in Good Plug-ins from GStreamer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.2%top 89.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, the isomp4 plugin's qtdemux_audio_caps function does not sufficiently validate atom data before performing division operations, leading to denial of service due to integer division by zero.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | gst-plugins-good | 1.26.3-r0 | ALPINE-CVE-2026-46470 |
| Alpine:v3.23 | openjdk17 | 17.0.21.0.3_p1-r0 | ALPINE-CVE-2026-46470 |
| Alpine:v3.24 | openjdk17 | 17.0.21.0.3_p1-r0 | ALPINE-CVE-2026-46470 |
| Alpine:v3.23 | openjdk21 | 21.0.13.0.3_p1-r0 | ALPINE-CVE-2026-46470 |
| Alpine:v3.24 | openjdk21 | 21.0.13.0.3_p1-r0 | ALPINE-CVE-2026-46470 |
| Debian:12 | gst-plugins-good1.0 | no fix listed | DEBIAN-CVE-2026-46470 |
| Debian:13 | gst-plugins-good1.0 | 1.26.2-1+deb13u1 | DEBIAN-CVE-2026-46470 |
| Debian:14 | gst-plugins-good1.0 | 1.28.2-1 | DEBIAN-CVE-2026-46470 |
| Ubuntu:22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.6 | USN-8317-1 |
| Ubuntu:22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.6 | UBUNTU-CVE-2026-46470 |
| Ubuntu:24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.4 | USN-8317-1 |
| Ubuntu:24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.4 | UBUNTU-CVE-2026-46470 |
| Ubuntu:25.10 | gst-plugins-good1.0 | 1.26.5-1ubuntu2.3 | UBUNTU-CVE-2026-46470 |
| Ubuntu:25.10 | gst-plugins-good1.0 | 1.26.5-1ubuntu2.3 | USN-8317-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GStreamer | Good Plug-ins | 0 – before 1.28.2 |
Weakness: CWE-369 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L