The vulnerability in GStreamer gst-plugins-good (avidemux) arises from improper handling of FUJIFILM metadata in AVI strd chunks. Specifically, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets without verifying sufficient data remains, causing an unsigned integer underflow for crafted payloads of exactly 106 or 107 bytes. This underflow results in subsequent null-terminated string scanning reading beyond the allocated heap buffer, and date-format normalization may write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash or denial of service. The avidemux element is auto-plugged by common GStreamer components, so merely opening or previewing a crafted AVI file can trigger the issue. The vulnerability is fixed upstream in gst-plugins-good version 1.28.6.

Exploitation of this flaw can lead to heap out-of-bounds reads and writes, potentially causing application crashes (denial of service) and disclosure of adjacent heap data. The vulnerability affects applications using the avidemux element in GStreamer when processing crafted AVI files with malicious FUJIFILM metadata. The impact includes confidentiality loss (heap information disclosure), integrity loss (out-of-bounds write), and availability loss (application crash).

A fix is available in gst-plugins-good version 1.28.6. Users and administrators should update to this version or later to remediate the vulnerability. The Red Hat advisory RHSA-2026:55434 provides updated packages for affected Red Hat Enterprise Linux versions. No additional mitigation is required once the update is applied.