CVE-2026-125041
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.