CVE-2026-46470 — GStreamer Gst-Plugins-Good Denial of Service

title: GStreamer MP4 Parsing Integer Division by Zero Attempt — CVE-2026-46470
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  Detects the execution of GStreamer related processes (gst-play-1.0, gst-launch-1.0) attempting to process MP4 files, which could indicate an attempt to exploit CVE-2026-46470. The vulnerability lies in the qtdemux_audio_caps function within the isomp4 plugin, which fails to validate atom data before division, leading to a denial of service via integer division by zero when parsing MP4 audio tracks. This rule specifically looks for GStreamer executables processing MP4 files, a prerequisite for triggering the vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-46470/
tags:
  - attack.execution
  - attack.t1204.002
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\GStreamer\'
          - '/usr/bin/gst-play-1.0'
          - '/usr/bin/gst-launch-1.0'
      CommandLine|contains:
          - '.mp4'
  selection_mp4_parsing:
      CommandLine|contains:
          - 'qtdemux_audio_caps'
  condition: selection AND selection_mp4_parsing
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse