A vulnerability in GStreamer's gst-plugins-good (avidemux) component allows out-of-bounds reads due to improper bounds checking in the Nikon metadata tag parser. This flaw can be triggered by opening or previewing a crafted AVI file, potentially causing application crashes or limited information disclosure. The issue is fixed in gst-plugins-good version 1.28.6.