GStreamer up to 1.24.10 AVI gst_avi_demux_riff_parse_vprp fields out-of-bounds

Summaryinfo

A vulnerability classified as critical was found in GStreamer. Affected is the function gst_avi_demux_riff_parse_vprp of the component AVI Handler. The manipulation of the argument fields results in out-of-bounds. This vulnerability is identified as CVE-2026-73434. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in GStreamer. It has been classified as critical. Affected is the function gst_avi_demux_riff_parse_vprp of the component AVI Handler. The manipulation of the argument fields with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

The advisory is shared for download at access.redhat.com. This vulnerability is traded as CVE-2026-73434 since 08/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 1.28.6 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Multimedia Processing Software

Name

• GStreamer

Version

• 0.10
• 1.0
• 1.10.2
• 1.10.3
• 1.16.0
• 1.18.4
• 1.24.10

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion