Integer underflow in GStreamer gst-plugins-good
Priority LOW 28CWE-191Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00148 4th percentileScored 2026-11-07
Fix Fixed gst-plugins-good (GStreamer): 1.28.6Red Hat: 11 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GStreamer | gst-plugins-good | before 1.28.6 | 1.28.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 1.26.7-2.el10_2.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 1.24.11-1.el10_0.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1.10.4-4.el7_9.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.16.1-7.el8_10.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1.16.1-4.el8_4.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 1.16.1-4.el8_4.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 1.16.1-4.el8_6.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | 1.16.1-4.el8_6.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 1.16.1-5.el8_8.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 1.16.1-5.el8_8.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.22.12-7.el9_8.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 1.18.4-8.el9_2.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | 1.22.1-4.el9_4.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 1.22.12-5.el9_6.3 | Patch available | CNA |
- gst-plugins-good VendorGStreamer Affected before 1.28.6 Fixed in 1.28.6 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.26.7-2.el10_2.5 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.24.11-1.el10_0.4 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.10.4-4.el7_9.3 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.16.1-7.el8_10.3 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.16.1-4.el8_4.2 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1.16.1-4.el8_4.2 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.16.1-4.el8_6.3 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1.16.1-4.el8_6.3 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.16.1-5.el8_8.3 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.16.1-5.el8_8.3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.22.12-7.el9_8.4 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.18.4-8.el9_2.3 Patch available CNA
- Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.22.1-4.el9_4.3 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.22.12-5.el9_6.3 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* | up to 1.28.6 | Vulnerable | GStreamer |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
- cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* Versions up to 1.28.6 Vulnerable ·GStreamer
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA gst-plugins-good (GStreamer) Fixed in 1.28.6
Red Hat 11 advisories
- RHSA-2026:70803 Released 2026-09-23 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) gstreamer1-plugins-good-1.16.1-4.el8_4.2, gstreamer1-plugins-good-gtk-1.16.1-4.el8_4.2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) gstreamer1-plugins-good-1.16.1-4.el8_4.2, gstreamer1-plugins-good-gtk-1.16.1-4.el8_4.2
- RHSA-2026:70584 Released 2026-09-23 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) gstreamer1-plugins-good-1.16.1-4.el8_6.3, gstreamer1-plugins-good-gtk-1.16.1-4.el8_6.3
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) gstreamer1-plugins-good-1.16.1-4.el8_6.3, gstreamer1-plugins-good-gtk-1.16.1-4.el8_6.3
- RHSA-2026:70264 Released 2026-09-22 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux Server (v. 7 ELS) gstreamer1-plugins-good-1.10.4-4.el7_9.3, gstreamer1-plugins-good-1.10.4-4.el7_9.3.ppc
Show 8 more Red Hat advisories
- RHSA-2026:69232 Released 2026-09-21 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) gstreamer1-plugins-good-1.16.1-5.el8_8.3, gstreamer1-plugins-good-gtk-1.16.1-5.el8_8.3
- Red Hat Enterprise Linux AppStream TUS (v.8.8) gstreamer1-plugins-good-1.16.1-5.el8_8.3, gstreamer1-plugins-good-gtk-1.16.1-5.el8_8.3
- RHSA-2026:68642 Released 2026-09-18 · Red Hat rating Importantgstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) gstreamer1-plugins-good-1.22.1-4.el9_4.3, gstreamer1-plugins-good-gtk-1.22.1-4.el9_4.3
- RHSA-2026:68644 Released 2026-09-17 · Red Hat rating Importantgstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) gstreamer1-plugins-good-1.22.12-5.el9_6.3, gstreamer1-plugins-good-gtk-1.22.12-5.el9_6.3
- RHSA-2026:68645 Released 2026-09-17 · Red Hat rating Importantgstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) gstreamer1-plugins-good-1.18.4-8.el9_2.3, gstreamer1-plugins-good-gtk-1.18.4-8.el9_2.3
- RHSA-2026:65959 Released 2026-09-09 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) gstreamer1-plugins-good-1.24.11-1.el10_0.4, gstreamer1-plugins-good-gtk-1.24.11-1.el10_0.4
- RHSA-2026:56966 Released 2026-08-19 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream (v. 8) gstreamer1-plugins-good-1.16.1-7.el8_10.3, gstreamer1-plugins-good-gtk-1.16.1-7.el8_10.3
- RHSA-2026:55436 Released 2026-08-17 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-good-1.22.12-7.el9_8.4, gstreamer1-plugins-good-gtk-1.22.12-7.el9_8.4
- RHSA-2026:55434 Released 2026-08-17 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream (v. 10) gstreamer1-plugins-good-1.26.7-2.el10_2.5, gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:56966
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:65959
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
Show 9 more groups
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:69232
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:70264
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:70584
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:70803
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-15282 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloadersPriority MEDIUM 41
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:55434
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:55436
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:68642
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:68644
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
- Advisory ·
GStreamer Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 13 more products — RHSA-2026:68645
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-51552 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingPriority LOW 26
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:55434 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:56966 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:55436 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:70803 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:70584 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:69232 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:68645 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:68642 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:65959 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:68644 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:70803 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:70584 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:69232 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:70264 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73433
- 2026-10-03 Alias added: GHSA-cq86-v72j-qxrj
References
Advisory 13
More Gstreamer vulnerabilities
- TI-2025-29786 In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read… CVSS 3.1HIGH 8.1
- TI-2024-31895 GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer CVSS 4.0HIGH 8.6
- TI-2024-31893 GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush CVSS 4.0HIGH 8.6
- TI-2024-31887 GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header CVSS 4.0HIGH 8.6
- TI-2024-31829 GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer CVSS 4.0HIGH 8.6
- TI-2024-31828 GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a CVSS 4.0HIGH 8.6
Sources
- CVE-2026-73433 · CVE Program
- CVE-2026-73433 · NVD
- FIRST EPSS
- GHSA-cq86-v72j-qxrj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-73433 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences