CyberRota Analysis
AI-GeneratedThe isomp4 plugin in GStreamer's gst-plugins-good is vulnerable to an integer overflow when processing specially crafted MP4 or MOV files with CEA-608 closed-caption data, allowing for an out-of-bounds heap read. This could lead to the disclosure of adjacent heap memory or cause the application to crash. Media developers and organizations utilizing GStreamer should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read of up to 244 bytes, which is then included in the downstream caption output. An attacker could exploit this by tricking a user into opening a malicious media file, potentially resulting in disclosure of adjacent heap memory or application crash.