{"id":"CVE-2026-125041","published":"2026-11-09T19:16:48.370","lastModified":"2026-11-10T19:21:06.080","description":"A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwes":["CWE-1284"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-125041","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569126","tags":[]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0025.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}