CVE-2026-17072
Received Received - Intake

Heap-based Out-of-Bounds Read in GStreamer gst-plugins-good

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Red Hat, Inc.

Description
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-17072
EUVD
EUVD-2026-49750

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gst gst-plugins-good to 1.28.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based out-of-bounds read vulnerability in GStreamer's gst-plugins-good library. It occurs when parsing FLAC audio stream headers inside Matroska or WebM container files. The flaw involves a boundary check that fails to account for the full data size, causing a 4-byte read past the end of a buffer. This happens in the function gst_matroska_parse_flac_stream_headers() when processing FLAC metadata blocks.

Detection Guidance

To detect this vulnerability, check the installed version of gst-plugins-good. Run: gst-inspect-1.0 --version. If the version is 1.28.5 or earlier, the system is vulnerable. Use AddressSanitizer to detect heap-based out-of-bounds reads during media file processing.

Impact Analysis

An attacker could exploit this by creating a malicious Matroska or WebM file containing FLAC audio. If a user opens this file with vulnerable software, it may leak a small amount of adjacent heap memory. This could potentially expose sensitive data or crash the application, though it does not allow code execution or data modification.

Compliance Impact

This vulnerability may lead to unauthorized information disclosure, which could violate data protection requirements under GDPR or HIPAA if sensitive data is leaked. Organizations using affected GStreamer versions should patch to mitigate compliance risks.

Mitigation Strategies

Upgrade gst-plugins-good to version 1.28.6 or later. Apply the patch from the merge request: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/111. Avoid opening untrusted Matroska or WebM files containing FLAC audio streams.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart