CVE-2026-73471: falha de média gravidade em GStreamer gst-plugins-good
Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.1%
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Produtos afetados
GStreamer · gst-plugins-goodCVEs relacionadas — GStreamer gst-plugins-good
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73433MEDIUMGstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/writeEPSS 0.1%CVE-2026-73434MEDIUMGstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingEPSS 0.1%CVE-2026-73472MEDIUMGstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds readEPSS 0.1%CVE-2026-73473MEDIUMGstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of serviceEPSS 0.1%