The vulnerability (CVE-2026-73433) exists in the gst_avi_demux_parse_strd() function of GStreamer's gst-plugins-good (avidemux) plugin. When parsing FUJIFILM metadata in an AVI strd chunk, the function decrements a remaining-length counter by fixed offsets without verifying that sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, this causes an unsigned integer underflow, resulting in the counter becoming a very large unsigned value. This leads to subsequent null-terminated string scanning reading beyond the allocated heap buffer and date-format normalization writing beyond the buffer end. Confirmed impacts include heap out-of-bounds read and write, heap information disclosure, and application crash or denial of service. The vulnerability can be triggered by simply opening or previewing a crafted AVI file. Red Hat has issued security advisories and patches for affected versions of gstreamer1-plugins-good in Red Hat Enterprise Linux 9 and 10.

Successful exploitation can cause heap out-of-bounds read and write, leading to potential information disclosure of adjacent heap data and application crashes resulting in denial of service. The vulnerability requires user interaction (opening or previewing a crafted AVI file) and does not require elevated privileges. The CVSS v3.1 base score is 6.6 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and high impact on availability.

A fix is available and has been officially released by Red Hat in updated gstreamer1-plugins-good packages for Red Hat Enterprise Linux 9 and 10. Users and administrators should apply these security updates promptly to remediate the vulnerability. Refer to Red Hat advisories RHSA-2026:55434 and RHSA-2026:55436 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the official patches.