The vulnerability in GStreamer gst-plugins-good (avidemux) arises from improper calculation of the number of gst_riff_vprp_video_field_desc entries by dividing the remaining buffer size by an attacker-controlled field value instead of the size of the descriptor structure. This miscalculation causes the parser to treat more descriptors as available than actually fit in the input buffer, resulting in out-of-bounds reads. Processing a maliciously crafted AVI file can trigger a crash, causing denial of service. The upstream fix is available in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). Red Hat Enterprise Linux 10 includes this component and is affected. The CVSS v3.1 score is 7.1 (high severity) with network attack vector, low complexity, no privileges required, user interaction required, and an impact primarily on availability with limited confidentiality impact.

An attacker can cause an application crash (denial of service) by processing a specially crafted AVI file, exploiting the out-of-bounds read in the gst-plugins-good avidemux component. The vulnerability may also leak memory contents that could aid in bypassing protection mechanisms like ASLR. There is no direct integrity impact. The flaw affects availability and confidentiality to a limited extent.

A fix is available upstream in gst-plugins-good version 1.28.6. Red Hat users should monitor the Red Hat advisory for the release of a patched package for Red Hat Enterprise Linux 10 and apply it once available. Until then, avoid processing untrusted AVI files with affected GStreamer components to mitigate risk. Patch status is not yet confirmed for Red Hat Enterprise Linux 10; check the vendor advisory for current remediation guidance.