CVE-2026-73433

Modified Modified - Updated After Analysis

Heap Buffer Overflow in GStreamer gst-plugins-good avidemux

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: redhat-SADP

Description

A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73433

EUVD

EUVD-2026-57444

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
gstreamer	gstreamer	to 1.28.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an unsigned integer underflow in GStreamer's gst-plugins-good avidemux component. When parsing FUJIFILM metadata in an AVI strd chunk, the function gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets without verifying sufficient data remains. For crafted payloads of 106 or 107 bytes, the counter underflows to a very large value, causing out-of-bounds reads and writes during string scanning and date-format normalization. This can lead to heap corruption, information disclosure, crashes, or denial of service.

Detection Guidance

To detect this vulnerability, check the installed version of gst-plugins-good. If it is below 1.28.6, the system is vulnerable. Run: gst-inspect-1.0 --version to check the version. Also, monitor for crashes or unusual behavior when processing AVI files.

Impact Analysis

The vulnerability can cause heap out-of-bounds reads and writes, leading to heap information disclosure where adjacent data in metadata may be exposed. It can also result in application crashes or denial of service. Since the avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, simply opening or previewing a crafted AVI file can trigger the issue.

Compliance Impact

This vulnerability primarily impacts system integrity and availability through memory corruption, crashes, or denial of service. It does not directly expose or leak sensitive data like personal or health information, which are key concerns for GDPR and HIPAA. However, if exploited to cause crashes or corruption in systems handling such data, it could indirectly affect compliance by disrupting processing or storage of regulated information.

Mitigation Strategies

Immediately update gst-plugins-good to version 1.28.6 or later. If updating is not possible, avoid opening or previewing untrusted AVI files. Disable auto-plugging of avidemux if feasible. Monitor for suspicious activity or crashes.

Hi! I’m here to help you understand CVE-2026-73433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70