The GNU/GStreamer gst-plugins-good suite contains a flaw in the isomp4 plugin, specifically in its UUID parsing function. Before version 1.28.2, the routine used during MP4 decoding may read beyond the boundary of a heap‑allocated buffer. This overflow enables an attacker to capture contents of heap memory that should otherwise remain protected, potentially revealing sensitive data.

The vulnerability resides in GStreamer gst-plugins-good, affecting any build of the isomp4 plugin that predates the 1.28.2 release. Systems running GStreamer before that version without an isolated or patched environment are susceptible.

An adversary can trigger the buffer overread by supplying a crafted MP4 file to a service that processes media with GStreamer. The trigger occurs during normal playback or file inspection and does not require elevated privileges; it could be remote if the application accepts user‑supplied files or local if the user can provide input. While the bug does not lead to code execution, the exposed heap data may be leveraged in subsequent attacks. The CVSS score is not provided, EPSS is unknown, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation to date.