Read the docs
TI-2026-85759 Aliases CVE-2026-73473GHSA-pgrm-9mgw-xj68

Missing entry count validation in GStreamer avidemux enables denial of service

Priority LOW 24CWE-770Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

GStreamer gst-plugins-good versions before 1.28.6 contain a flaw in the avidemux subindex parser where the entry count is not validated. A crafted AVI file can cause excessive memory allocation, leading to denial of service (CWE-770). Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, a local attacker needs no privileges to trigger it by opening or previewing a crafted AVI file, though user interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Why it matters now

EPSS 0.00124 2nd percentileScored 2026-11-07
Fix Fixed gst-plugins-good (GStreamer): 1.28.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GStreamergst-plugins-goodbefore 1.28.61.28.6Patch availableCNA
  • gst-plugins-good VendorGStreamer Affected before 1.28.6 Fixed in 1.28.6 Patch available CNA

Remediation

Upgrade gst-plugins-good to version 1.28.6, which fixes the issue upstream in GStreamer-SA-2026-0072.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA gst-plugins-good (GStreamer) Fixed in 1.28.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GStreamer gst-plugins-good 1.28.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85758 Integer overflow in GStreamer AVI demuxer causes out-of-bounds readPriority LOW 26
    • TI-2026-85757 Out-of-bounds read in GStreamer avidemux Nikon metadata parsingPriority LOW 26
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-73473
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-06 Alias added: GHSA-pgrm-9mgw-xj68
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2025-29786 In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read… CVSS 3.1HIGH 8.1
  • TI-2024-31895 GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31893 GHSL-2024-118: GStreamer has a null pointer dereference in gst_gdk_pixbuf_dec_flush CVSS 4.0HIGH 8.6
  • TI-2024-31887 GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header CVSS 4.0HIGH 8.6
  • TI-2024-31829 GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer CVSS 4.0HIGH 8.6
  • TI-2024-31828 GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a CVSS 4.0HIGH 8.6
See all 122 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences