A flaw was found in GStreamer gst-plugins-good (avidemux). (CVE-2026-73434)
A vulnerability in GStreamer's gst-plugins-good (avidemux) component allows out-of-bounds reads due to improper calculation of available video field descriptors in AVI parsing. This flaw can cause application crashes (denial of service) when processing crafted AVI files. The issue is fixed in updated versions of gst-plugins-good released by Red Hat for Red Hat Enterprise Linux 9 and 10.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-73434) exists in the gst_avi_demux_riff_parse_vprp() function of GStreamer's gst-plugins-good (avidemux). The number of available gst_riff_vprp_video_field_desc entries is incorrectly calculated by dividing the remaining buffer size by an attacker-controlled value (vprp->fields) instead of the size of the descriptor structure. This miscalculation leads to out-of-bounds reads of the input buffer. Processing a crafted AVI file via playbin or decodebin can trigger a crash, resulting in denial of service. The issue has been fixed upstream in gst-plugins-good version 1.28.6 and patched in Red Hat Enterprise Linux 9 and 10 packages.
Potential Impact
An attacker can cause a denial of service by triggering out-of-bounds reads in the AVI demuxer plugin of GStreamer, crashing applications that use gst-plugins-good to process crafted AVI files. The vulnerability does not impact confidentiality or integrity but affects availability.
Mitigation Recommendations
Official patches are available from Red Hat for Red Hat Enterprise Linux 9 and 10. Users should apply the updated gstreamer1-plugins-good packages as provided in advisories RHSA-2026:55434 and RHSA-2026:55436. Refer to Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying these official fixes.
A flaw was found in GStreamer gst-plugins-good (avidemux). (CVE-2026-73434)
Description
A vulnerability in GStreamer's gst-plugins-good (avidemux) component allows out-of-bounds reads due to improper calculation of available video field descriptors in AVI parsing. This flaw can cause application crashes (denial of service) when processing crafted AVI files. The issue is fixed in updated versions of gst-plugins-good released by Red Hat for Red Hat Enterprise Linux 9 and 10.
CVSS v3.1
Score 7.1high
Affected software
pkg:github/gstreamer/gst-plugins-goodRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-73434) exists in the gst_avi_demux_riff_parse_vprp() function of GStreamer's gst-plugins-good (avidemux). The number of available gst_riff_vprp_video_field_desc entries is incorrectly calculated by dividing the remaining buffer size by an attacker-controlled value (vprp->fields) instead of the size of the descriptor structure. This miscalculation leads to out-of-bounds reads of the input buffer. Processing a crafted AVI file via playbin or decodebin can trigger a crash, resulting in denial of service. The issue has been fixed upstream in gst-plugins-good version 1.28.6 and patched in Red Hat Enterprise Linux 9 and 10 packages.
Potential Impact
An attacker can cause a denial of service by triggering out-of-bounds reads in the AVI demuxer plugin of GStreamer, crashing applications that use gst-plugins-good to process crafted AVI files. The vulnerability does not impact confidentiality or integrity but affects availability.
Mitigation Recommendations
Official patches are available from Red Hat for Red Hat Enterprise Linux 9 and 10. Users should apply the updated gstreamer1-plugins-good packages as provided in advisories RHSA-2026:55434 and RHSA-2026:55436. Refer to Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying these official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wfhj-v65x-vjp5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73434"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Patch Information
Threat ID: 6a833370bf8831d5392a8484
Added to database: 08/17/2026, 16:14:40 UTC
Last enriched: 08/17/2026, 16:37:06 UTC
Last updated: 08/17/2026, 16:50:08 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.