This vulnerability in GStreamer's gst-plugins-good arises from a heap-based out-of-bounds read triggered by improper boundary checking during parsing of FLAC audio stream headers within Matroska or WebM containers. The flaw allows reading 4 bytes beyond the allocated buffer, potentially leaking adjacent heap memory. It requires user interaction to open a maliciously crafted media file. The CVSS 3.1 base score is 3.3, reflecting low impact with local attack vector, low complexity, no privileges required, and user interaction needed. No official remediation level or patch information is provided in the vendor advisory, and no known exploits are reported in the wild.

An attacker can cause a heap-based out-of-bounds read of 4 bytes, potentially leaking a small amount of adjacent heap memory. There is no indication of code execution, privilege escalation, or denial of service. The impact is limited to information disclosure with low severity.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17072 for current remediation guidance. No official fix or workaround is specified in the provided advisory content. Users should avoid opening untrusted Matroska or WebM files containing FLAC audio streams until a fix is available.