CVE-2026-73472 in gst-plugins-good
Summary
by MITRE • 11/06/2026
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified within GStreamer's gst-plugins-good component specifically affects the avidemux plugin, which serves as a critical element for handling Audio Video Interleave file formats in multimedia pipelines. This flaw manifests during the parsing of superindex and subindex structures embedded within AVI files. The core technical issue stems from an integer overflow condition that occurs when processing these index entries. In C-based media frameworks like GStreamer, arithmetic operations on buffer sizes or array indices are common but require rigorous validation to prevent memory corruption. When the parser calculates offsets or lengths based on user-supplied data without adequate bounds checking prior to the operation, a crafted input can cause the resulting value to wrap around due to integer overflow. This wrapped value is significantly smaller than intended, allowing it to pass subsequent boundary checks that would normally reject such out-of-bounds access attempts.
The operational consequence of this logic error is an out-of-reads vulnerability. Because the flawed calculation permits access to memory locations outside the allocated buffer boundaries, an attacker can craft a malicious AVI file containing specially constructed superindex and subindex entries. When a victim opens or previews this file using any GStreamer-based application that utilizes playbin, decodebin, or gst-discoverer elements, the avidemux plugin is automatically plugged into the pipeline to handle the stream. This auto-plugging mechanism means that no complex user interaction beyond opening the file is required to trigger the exploit. The out-of-bounds read can lead to information disclosure by leaking sensitive data from adjacent memory regions, or potentially facilitate further exploitation if combined with other vulnerabilities in the application context.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-190 Integer Overflow and CWE-787 Out-of-bounds Read. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with techniques involving invalid memory access to gather intelligence or destabilize applications for denial of service purposes. The automatic nature of the plugin loading in GStreamer's high-level elements significantly increases the attack surface, as many media players and video processing tools rely on these generic pipeline builders rather than explicitly instantiating specific decoders. This design choice prioritizes convenience but inadvertently lowers the barrier for exploitation by ensuring that vulnerable plugins are always active when handling corresponding file types.
Mitigation strategies primarily involve updating to a patched version of GStreamer, specifically gst-plugins-good 1.28.6 or later, where this issue has been resolved upstream under security advisory GStreamer-SA-2026-0072. For environments unable to update immediately, implementing strict file type validation and sandboxing media processing applications can reduce the risk of successful exploitation. Additionally, disabling auto-plugging for specific plugins if they are not strictly necessary in a given pipeline configuration may provide an additional layer of defense against automated attacks targeting known vulnerable components within the GStreamer ecosystem.