CVE-2026-73434 in GStreamer
Summary
by MITRE • 08/12/2026
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within the GStreamer multimedia framework's gst-plugins-good package, specifically in the avidemux component that handles AVI file parsing. The flaw manifests in the gst_avi_demux_riff_parse_vprp() function where buffer boundary calculations are performed incorrectly, creating a classic out-of-bounds memory access condition that can be exploited by malicious actors. The vulnerability stems from a mathematical error in how the parser determines available field descriptor entries by using an attacker-controlled value instead of the proper structure size for buffer calculations.
The technical implementation flaw occurs when processing AVI files through the playbin or decodebin components, where the system divides the remaining buffer size by the vprp->fields value rather than by the actual sizeof(gst_riff_vprp_video_field_desc) structure. This mathematical error allows an attacker to manipulate the parsing logic such that the parser incorrectly calculates available memory slots for video field descriptors. When the attacker-controlled fields value is smaller than the actual structure size, the calculation results in a larger number of entries being treated as available than actually exist in the input buffer, leading to memory access violations.
The operational impact of this vulnerability extends beyond simple application crashes to potentially enable more sophisticated exploitation techniques. When an application processes a crafted AVI file through the vulnerable playbin or decodebin components, the out-of-bounds read conditions can cause immediate denial of service by crashing the multimedia application. This affects any software that relies on GStreamer for media processing, including media players, streaming applications, and content management systems that utilize these components for AVI file handling.
Security implications of this vulnerability align with CWE-129 and CWE-787, representing improper input validation and out-of-bounds read conditions respectively. The flaw also maps to ATT&CK technique T1203 by enabling application crash conditions that can be leveraged for denial of service attacks against multimedia applications. The vulnerability affects systems where GStreamer is deployed as a media processing framework, particularly those handling untrusted AVI content from web downloads, email attachments, or other potentially malicious sources.
Mitigation strategies should focus on immediate patching to version 1.28.6 or later, which contains the fixed implementation that properly calculates buffer boundaries using the correct structure sizes rather than attacker-controlled values. Organizations should also implement input validation measures for AVI files, particularly in environments where untrusted media content is processed. Network-level filtering and sandboxing of multimedia processing components can provide additional defense-in-depth layers. Regular security assessments of multimedia frameworks and proactive monitoring for similar buffer boundary issues in other GStreamer plugins should be implemented to prevent future vulnerabilities of this nature.
The vulnerability demonstrates the critical importance of proper buffer management in multimedia parsing libraries, where incorrect arithmetic operations can lead to memory safety violations with significant impact on application stability and security posture. This particular flaw underscores the need for rigorous input validation and boundary checking in code that processes structured binary formats like AVI files, which contain complex metadata sections that require careful parsing to prevent exploitation opportunities.