Heap Buffer Overflow in GStreamer’s Avidemux Component

CVE-2026-73433

What is CVE-2026-73433?

A flaw in GStreamer’s gst-plugins-good, particularly within its Avidemux component, is triggered when processing FUJIFILM metadata in AVI files. During parsing, the function gst_avi_demux_parse_strd() incorrectly manages a length counter, leading to a counter underflow when specific crafted payloads are processed. This results in severe consequences: allowing for heap out-of-bounds reads, writes, and potential heap information disclosure, which exposes adjacent data in the parsed metadata. The faulty element is auto-plugged by playbin, decodebin, and gst-discoverer, making it easy to trigger this vulnerability simply by opening a specially crafted AVI file, thus risking application integrity and causing service disruptions. Upstream fixes are available in gst-plugins-good version 1.28.6.

References