Vulnerability Description
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2026-17072
- https://bugzilla.redhat.com/show_bug.cgi?id=2506750
- https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/111
FAQ
What is CVE-2026-17072?
CVE-2026-17072 is a vulnerability with a CVSS score of 3.3 (LOW). A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnera...
How severe is CVE-2026-17072?
CVE-2026-17072 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-17072?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.