Vulnerability Description
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gstreamer | Gstreamer | < 1.28.6 |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:55434Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:55436Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:56966
- https://access.redhat.com/errata/RHSA-2026:65959
- https://access.redhat.com/errata/RHSA-2026:68642
- https://access.redhat.com/errata/RHSA-2026:68644
- https://access.redhat.com/errata/RHSA-2026:68645
- https://access.redhat.com/security/cve/CVE-2026-73434Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2514807Issue TrackingThird Party Advisory
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231Issue Tracking
- https://gstreamer.freedesktop.org/security/sa-2026-0072.htmlPatchVendor Advisory
FAQ
What is CVE-2026-73434?
CVE-2026-73434 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining bu...
How severe is CVE-2026-73434?
CVE-2026-73434 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73434?
Check the references section above for vendor advisories and patch information. Affected products include: Gstreamer Gstreamer, Redhat Enterprise Linux.