Heap Buffer Overflow in GStreamer’s Avidemux Component
CVE-2026-73433

6.6MEDIUM

Key Information:

Vendor

Gstreamer

Status
Gst-plugins-good
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73433?

A flaw in GStreamer’s gst-plugins-good, particularly within its Avidemux component, is triggered when processing FUJIFILM metadata in AVI files. During parsing, the function gst_avi_demux_parse_strd() incorrectly manages a length counter, leading to a counter underflow when specific crafted payloads are processed. This results in severe consequences: allowing for heap out-of-bounds reads, writes, and potential heap information disclosure, which exposes adjacent data in the parsed metadata. The faulty element is auto-plugged by playbin, decodebin, and gst-discoverer, making it easy to trigger this vulnerability simply by opening a specially crafted AVI file, thus risking application integrity and causing service disruptions. Upstream fixes are available in gst-plugins-good version 1.28.6.

Affected Version(s)

gst-plugins-good 0 < 1.28.6

Red Hat Enterprise Linux 10 0:1.26.7-2.el10_2.5

Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.24.11-1.el10_0.4

References

https://access.redhat.com/errata/RHSA-2026:55434
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55436
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56966
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Seonwook Kim for reporting this issue.
.