CVE-2026-73473: falha de média gravidade em GStreamer gst-plugins-good
Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.1%
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
GStreamer · gst-plugins-goodCVEs relacionadas — GStreamer gst-plugins-good
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73433MEDIUMGstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/writeEPSS 0.1%CVE-2026-73434MEDIUMGstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsingEPSS 0.1%CVE-2026-73472MEDIUMGstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds readEPSS 0.1%CVE-2026-73471MEDIUMGstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsingEPSS 0.1%