CVE-2026-73472: falha de média gravidade em GStreamer gst-plugins-good
Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds read
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.1%
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Produtos afetados
GStreamer · gst-plugins-goodCVEs relacionadas — GStreamer gst-plugins-good
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73433MEDIUMGstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/writeEPSS 0.1%CVE-2026-73434MEDIUMGstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingEPSS 0.1%CVE-2026-73473MEDIUMGstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of serviceEPSS 0.1%CVE-2026-73471MEDIUMGstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsingEPSS 0.1%