ZeroDay Findings
Sign inSign up

Findings

CVE-2026-73434

A flaw was found in GStreamer gst-plugins-good (avidemux).

Published Aug 12, 2026 · updated Oct 15, 2026

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 12, 2026 · OSV.dev

    Detected

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the i

  2. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.22.0-5+deb12u4; gst-plugins-good1.0 fixed in 1.28.6-1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.22.0-5+deb12u4

  4. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.28.6-1

  5. Oct 15, 2026 · OSV.dev

    Updated

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the i

Affected

  • Debian:12 gst-plugins-good1.00 → 1.22.0-5+deb12u4
  • Debian:13 gst-plugins-good1.01.26.10-1, 1.26.2-1, 1.26.2-1+deb13u1
  • Debian:14 gst-plugins-good1.00 → 1.28.6-1

Sources

References