GStreamer gst-plugins-good MP4 Audio Track Parsing Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in GStreamer gst-plugins-good versions prior to 1.28.2. The issue arises in the isomp4 plugin's qtdemux_parse_trak function, which fails to properly validate atom data when parsing MP4 audio tracks. This lack of validation allows for division operations to be performed on zero values, leading to integer division by zero and causing application crashes.

Impact

Exploitation of this vulnerability leads to a crash of the application. The out-of-bounds reads could potentially allow for information disclosure.

Remediation

Users can upgrade to GStreamer gst-plugins-good version 1.28.2 or apply the available patch and recompile.