Read the docs
TI-2026-85757 Aliases CVE-2026-73471GHSA-6j9h-8973-mvh6

Out-of-bounds read in GStreamer avidemux Nikon metadata parsing

Priority LOW 26CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

GStreamer gst-plugins-good versions before 1.28.6 contain an out-of-bounds read in the avidemux plugin's Nikon metadata tag parser. The parser dereferences a pointer without checking that data remains in the buffer (CWE-125). Because playbin, decodebin and gst-discoverer auto-plug avidemux, opening or previewing a crafted AVI file is enough to trigger the flaw. The CVSS 3.1 vector requires user interaction and local access, and it rates confidentiality impact as low and availability impact as high.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0012 1st percentileScored 2026-11-07
Fix Fixed gst-plugins-good (GStreamer): 1.28.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GStreamergst-plugins-goodbefore 1.28.61.28.6Patch availableCNA
  • gst-plugins-good VendorGStreamer Affected before 1.28.6 Fixed in 1.28.6 Patch available CNA

Remediation

Upgrade gst-plugins-good to version 1.28.6 or later, which fixes the flaw upstream in GStreamer-SA-2026-0072.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA gst-plugins-good (GStreamer) Fixed in 1.28.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GStreamer gst-plugins-good 1.28.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85758 Integer overflow in GStreamer AVI demuxer causes out-of-bounds readPriority LOW 26
    • TI-2026-85759 Missing entry count validation in GStreamer avidemux enables denial of servicePriority LOW 24
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-73471
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-06 Alias added: GHSA-6j9h-8973-mvh6
  5. 2026-11-06 CISA SSVC decision points changed
  6. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2025-29786 In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read… CVSS 3.1HIGH 8.1
  • TI-2024-31895 GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31893 GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush CVSS 4.0HIGH 8.6
  • TI-2024-31887 GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header CVSS 4.0HIGH 8.6
  • TI-2024-31829 GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31828 GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a CVSS 4.0HIGH 8.6
See all 122 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences