Out-of-Bounds Read Vulnerability in GStreamer Avidemux Plugin

CVE-2026-73434

What is CVE-2026-73434?

A vulnerability exists in the GStreamer gst-plugins-good (avidemux) that could lead to out-of-bounds reads due to improper buffer size calculations. Specifically, the flaw occurs in the gst_avi_demux_riff_parse_vprp() function, where the number of available video field descriptors is incorrectly determined. Instead of accurately calculating based on the size of the descriptor structure, it divides the buffer size by an attacker-controlled value, potentially allowing the parser to access memory outside the intended range. This can result in application crashes when processing specially crafted AVI files via playbin or decodebin, effectively leading to a denial of service. The issue has been addressed in the upstream release of gst-plugins-good version 1.28.6.

References