A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4086 advisory.

    GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-31143. (CVE-2026-111183)

    GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote     attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library     is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

    The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of     validating the existence of an object prior to performing operations on the object. An attacker can     leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.
    (CVE-2026-18299)

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4     plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an     attacker to disclose heap memory contents. (CVE-2026-46471)

    A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or     MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can     bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes,     which is then included in the downstream caption output. An attacker could exploit this by tricking a user     into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or     application crash. (CVE-2026-88914)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3353 advisory.

    GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation.

    The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of     proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An     attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-     CAN-31143. (CVE-2026-111183)

    GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote     attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library     is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

    The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of     validating the existence of an object prior to performing operations on the object. An attacker can     leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787.
    (CVE-2026-18299)

    An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4     plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an     attacker to disclose heap memory contents. (CVE-2026-46471)

    A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or     MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can     bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes,     which is then included in the downstream caption output. An attacker could exploit this by tricking a user     into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or     application crash. (CVE-2026-88914)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4837 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4837-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 15, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     Version        : 1.22.0-5+deb12u4     CVE ID         : CVE-2025-47183 CVE-2026-1940 CVE-2026-3083 CVE-2026-3085                      CVE-2026-17072 CVE-2026-18298 CVE-2026-18299 CVE-2026-39043                      CVE-2026-39044 CVE-2026-53705 CVE-2026-73433 CVE-2026-73434                      CVE-2026-88914

    Multiple vulnerabilities were discovered in gst-plugins-good1.0, a collection     of plugins for the GStreamer multimedia framework. Processing specially     crafted media files or RTP streams could result in denial of service,     disclosure of information or execution of arbitrary code.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.0-5+deb12u4.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8863-1 advisory.

    Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2026-17072)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2026-73433)

    Seonwook Kim discovered that GStreamer Good Plugins did not correctly parse certain AVI files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-73434)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly handled certain closed caption data. An     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88914)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or     MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can     bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes,     which is then included in the downstream caption output. An attacker could exploit this by tricking a user     into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or     application crash. (CVE-2026-88914)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377931	Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2026-4086)	Nessus	Amazon Linux Local Security Checks	Local	critical
374351	Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-3353)	Nessus	Amazon Linux Local Security Checks	Local	critical
366229	Debian dla-4837 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	Local	high
362685	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Good Plugins vulnerabilities (USN-8863-1)	Nessus	Ubuntu Local Security Checks	Local	medium
344704	Linux Distros Unpatched Vulnerability : CVE-2026-88914	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88914

medium

Tenable Plugins

critical

critical

high

medium

medium