The vulnerability in GStreamer gst-plugins-good (avidemux) arises from improper handling of a remaining-length counter during parsing of FUJIFILM metadata in AVI strd chunks. Specifically, gst_avi_demux_parse_strd() decrements this counter by fixed offsets (98 and 10 bytes) without verifying that sufficient data remains. For crafted payloads of exactly 106 or 107 bytes, this causes the counter to underflow to a large unsigned value, leading to subsequent null-terminated string scanning reading far beyond the allocated heap buffer. Additionally, date-format normalization may write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash or denial of service. The avidemux element is auto-plugged by common GStreamer elements such as playbin, decodebin, and gst-discoverer, so simply opening or previewing a crafted AVI file can trigger the issue. The vulnerability is fixed upstream in gst-plugins-good version 1.28.6 (GStreamer-SA-2026-0072).

Successful exploitation can lead to heap out-of-bounds read and write, resulting in information disclosure of adjacent heap data, application crashes, and denial of service. The vulnerability affects the integrity, availability, and confidentiality of the affected system. The CVSS v3.1 score is 7.6 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and impacts including low confidentiality and integrity impact but high availability impact.

A fix is available upstream in gst-plugins-good version 1.28.6. Users and administrators should upgrade to this version or later to remediate the vulnerability. Since the vulnerability is triggered by opening or previewing crafted AVI files, avoiding untrusted AVI files until patched can reduce risk. There is no indication from the vendor advisory that any other mitigations or workarounds are available or necessary.