CVE-2026-88914

What it actually does

An integer overflow in 32-bit unsigned arithmetic in GStreamer’s gst-plugins-good isomp4 CEA-608 caption parser can bypass a bounds check when a crafted MP4 or MOV is demuxed. The result is an out-of-bounds heap read of up to 244 bytes that is copied into downstream caption output, exposing adjacent heap contents and/or crashing the media pipeline. Integrity of media or host state is not affected; impact is limited confidentiality (small heap disclosure) and availability (process crash). User interaction is required and the attack is local to the process that parses the file.

Why it matters to the business

Risk to the business is low-to-moderate for most organizations: CVSS 4.4, EPSS ~0.0012 with no 30-day increase, no KEV listing, no ransomware association, and no public exploit maturity. The realistic outcomes are a media player, transcoder, or GStreamer-based pipeline crashing, or leaking a small amount of process memory into caption text if untrusted MP4/MOV files are opened. Desktop users, kiosks, and unattended ingest/transcode workers that auto-process uploaded or emailed video are the main operational exposure. There is no evidence of widespread in-the-wild exploitation 31 days after publication, so this is a standard patch-and-harden item rather than an emergency incident.

How an attack unfolds

An attacker prepares an MP4 or MOV whose CEA-608 closed-caption payload is sized to trigger the unsigned 32-bit overflow in the isomp4 caption parser. The file is delivered as a normal media attachment, download, or shared link. When a user or automated pipeline opens it with a GStreamer stack that includes gst-plugins-good, the overflow defeats the parser’s length check, adjacent heap bytes are read and emitted as caption data, and the process may abort. No remote unauthenticated code execution is described; success depends on the victim processing the file and on heap layout at parse time. Named threat actors and KEV/ransomware use are not associated with this CVE.

How to fix it

Apply the vendor/distribution update for GStreamer gst-plugins-good (isomp4) as soon as a patched package is published for your OS or media stack; no specific fixed versions were supplied with this record, so follow your distro, Flatpak, or upstream GStreamer security advisory and upgrade the entire GStreamer plugin set together. Until patched: do not open untrusted MP4/MOV files in GStreamer-based players; isolate media ingest and transcode in a least-privilege sandbox or container without access to secrets; disable or do not load the isomp4/CEA-608 caption path where closed captions are not required; restrict who can upload media into automated pipelines. Rebuild or redeploy any bundled runtimes (appliances, kiosks, CI media workers) that vendor GStreamer rather than only patching desktops.

How to confirm the fix worked

Confirm installed gst-plugins-good / libgstrtspserver / isomp4 plugin packages match the patched version in your vendor advisory (package manager, container image SBOM, or gst-inspect-1.0 version output). After upgrade, process a corpus of legitimate MP4/MOV files with CEA-608 captions and confirm playback and caption rendering still succeed without crashes. Search inventories for unpatched GStreamer in desktops, media servers, transcode farms, and embedded players. Do not use untrusted crash-PoC media as a production test.

Typical attack path

1. Craft or obtain an MP4/MOV containing malformed CEA-608 closed-caption data aimed at the isomp4 caption parser
2. Deliver the file via email, messaging, web download, removable media, or an upload into a media-ingest workflow
3. Induce a user or automated GStreamer-based player/transcoder to open or demux the file
4. isomp4 parses captions; the integer overflow bypasses the bounds check
5. Up to 244 bytes of adjacent heap are read and included in caption output, and/or the process crashes
6. Attacker recovers leaked bytes from displayed/logged captions if they can observe output, or uses the crash for disruption

How to detect it

This issue leaks a small amount of heap into caption output or crashes the parser; it does not drop a distinctive implant. Hunt historically for GStreamer player/transcode crashes (SIGSEGV/SIGABRT) while demuxing MP4/MOV, especially around caption/CEA-608 handling, in the window since publication. Review application logs from gst-launch, gst-play, Totem, and custom GStreamer pipelines for isomp4 or closed-caption parser errors coinciding with a user-opened or uploaded media file. Capture cores and check whether the faulting module is the isomp4 plugin and the stack is in caption parsing. If caption text is logged or recorded, look for sudden binary/non-printable runs in CEA-608 output after a specific file. Network IOCs are not expected; delivery is a local file. No named APT campaigns are tied to this CVE, so do not expect unique C2. Absence of crashes does not prove the leak did not occur.

• libgstisomp4
• gst-plugins-good
• isomp4
• CEA-608
• gst-play-1.0
• gst-launch-1.0
• SIGSEGV in GStreamer after MP4/MOV open
• closed-caption parser / caption parse crash in isomp4

What your security team should do

• Treat as a standard patch cycle item, not an emergency: low CVSS, very low stable EPSS, not in KEV, no known exploits
• Inventory hosts and images that ship GStreamer gst-plugins-good and prioritize unattended media ingest/transcode over interactive desktops
• Patch or rebuild those images; sandbox remaining unpatched media parsers
• Block or quarantine untrusted MP4/MOV at email/web gateways for high-risk groups until patch coverage is high
• Watch for GStreamer process crashes and core dumps tied to isomp4/caption parsing as a stopgap detection control
• Reassess only if exploit code appears or EPSS/KEV status changes