Integer Overflow Vulnerability in GStreamer Plugin Affects User Safety
CVE-2026-73472

6.1MEDIUM

Key Information:

Vendor

Gstreamer

Status
Gst-plugins-good
Vendor
CVE Published:
6 November 2026

What is CVE-2026-73472?

A vulnerability exists in the GStreamer gst-plugins-good related to the parsing mechanisms of superindex and subindex. This flaw allows for integer overflow, bypassing vital bounds checks and enabling out-of-bounds reads. The issue is triggered when handling specially crafted AVI files, which could lead to unintended access to memory locations, potentially compromising system stability or revealing sensitive information. The vulnerability is integrated into various GStreamer components including playbin, decodebin, and gst-discoverer, making it easily exploitable during normal media operations. Affected versions have been patched in upstream release 1.28.6, following GStreamer Security Advisory SA-2026-0072.

Affected Version(s)

gst-plugins-good 0 < 1.28.6

References

https://access.redhat.com/security/cve/CVE-2026-73472
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514914
issue-trackingx_refsource_REDHAT
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Seonwook Kim for reporting this issue.
.