Read the docs
TI-2026-85758 Aliases CVE-2026-73472GHSA-w4qv-7936-q2x3

Integer overflow in GStreamer AVI demuxer causes out-of-bounds read

Priority LOW 26CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

GStreamer gst-plugins-good versions before 1.28.6 are affected. In the superindex and subindex parsers of the avidemux plugin, an integer overflow (CWE-190) bypasses bounds checks and causes out-of-bounds reads. A local attacker can trigger it when a user opens or previews a crafted AVI file, because playbin, decodebin and gst-discoverer auto-plug avidemux.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Why it matters now

EPSS 0.00129 2nd percentileScored 2026-11-07
Fix Fixed gst-plugins-good (GStreamer): 1.28.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GStreamergst-plugins-goodbefore 1.28.61.28.6Patch availableCNA
  • gst-plugins-good VendorGStreamer Affected before 1.28.6 Fixed in 1.28.6 Patch available CNA

Remediation

Upgrade gst-plugins-good to version 1.28.6, which fixes the issue upstream in GStreamer-SA-2026-0072.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA gst-plugins-good (GStreamer) Fixed in 1.28.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GStreamer gst-plugins-good 1.28.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85757 Out-of-bounds read in GStreamer avidemux Nikon metadata parsingPriority LOW 26
    • TI-2026-85759 Missing entry count validation in GStreamer avidemux enables denial of servicePriority LOW 24
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-73472
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-06 Alias added: GHSA-w4qv-7936-q2x3
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2025-29786 In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read… CVSS 3.1HIGH 8.1
  • TI-2024-31895 GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31893 GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush CVSS 4.0HIGH 8.6
  • TI-2024-31887 GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header CVSS 4.0HIGH 8.6
  • TI-2024-31829 GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31828 GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a CVSS 4.0HIGH 8.6
See all 122 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences