CVE-2026-125041

MediumCVSS 5.5/10Last modified Nov 10, 2026

Description

A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1250456.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine CVE-2026-1250465.3Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control CVE-2026-125057.8A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user in CVE-2026-1250559.8The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up CVE-2026-1250634.3A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard CVE-2026-1250645.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_g CVE-2026-1250655.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bit CVE-2026-1250665.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c be CVE-2026-1250675.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_g CVE-2026-1250685.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c CVE-2026-1250694.7FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_g CVE-2026-125079.1Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, a