CVE-2026-73433 Overview
CVE-2026-73433 is an integer underflow vulnerability [CWE-191] in the GStreamer gst-plugins-good avidemux element. The flaw resides in gst_avi_demux_parse_strd(), which decrements a remaining-length counter by fixed offsets of 98 and 10 bytes without validating that sufficient data remains. Crafted AVI files containing strd chunks of exactly 106 or 107 bytes cause the counter to underflow to a large unsigned value. Subsequent null-terminated string scanning then reads far beyond the allocated heap buffer, and date-format normalization can write past the buffer end. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so merely opening or previewing a malicious AVI triggers the bug.
Critical Impact
Opening or previewing a crafted AVI causes heap out-of-bounds read and write, heap information disclosure, and application crash.
Affected Products
- GStreamer gst-plugins-good versions prior to 1.28.6
- Applications using playbin, decodebin, or gst-discoverer for AVI parsing
- Linux distributions bundling vulnerable GStreamer plugins (see Red Hat advisory)
Discovery Timeline
- 2026-08-12 - CVE CVE-2026-73433 published to NVD
- 2026-08-12 - Last updated in NVD database
- GStreamer-SA-2026-0072 - Fix released upstream in gst-plugins-good 1.28.6
Technical Details for CVE-2026-73433
Vulnerability Analysis
The vulnerability is an integer underflow in the FUJIFILM metadata parser inside the AVI demuxer. gst_avi_demux_parse_strd() tracks how many bytes remain in the strd chunk using an unsigned counter. The parser subtracts a fixed 98 bytes for one header region and a further 10 bytes for a date field, but never confirms the counter still holds those values before subtracting. When the chunk is exactly 106 or 107 bytes long, the second subtraction wraps the counter to a value near UINT_MAX.
Once the counter underflows, the parser continues to scan for null-terminated strings using the corrupted length as an upper bound. This reads past the end of the heap allocation holding the chunk data. A follow-on date-format normalization step may also write bytes beyond the buffer, producing an out-of-bounds write. Adjacent heap contents can appear in the parsed metadata, leaking information to the attacker, and process termination results in denial of service.
Root Cause
The root cause is missing length validation before arithmetic on an unsigned counter [CWE-191]. Rather than checking remaining >= 98 and remaining >= 10 before each subtraction, the code performs the subtractions unconditionally. Combined with unbounded string scanning and date normalization, the underflow escapes the parser's intended bounds.
Attack Vector
Exploitation requires an attacker to deliver a crafted AVI file to a victim who opens or previews it. Because playbin, decodebin, and gst-discoverer auto-plug the avidemux element, any application built on GStreamer, including file managers generating thumbnails, may trigger the parser without explicit user action beyond browsing to the file.
No verified public exploit code has been released. The vulnerability mechanism is described in the GStreamer Security Advisory SA-2026-0072 and the GitLab Merge Request #12231 that contains the fix.
Detection Methods for CVE-2026-73433
Indicators of Compromise
- AVI files containing an strd chunk with a length field of exactly 106 or 107 bytes
- FUJIFILM metadata markers inside AVI strd payloads sourced from untrusted senders
- Crash reports or core dumps from processes loading libgstavi.so or invoking gst-discoverer
Detection Strategies
- Inspect AVI files at ingress with a parser that reports strd chunk sizes and flags values in the 106 to 107 byte range
- Monitor for segmentation faults or GStreamer warnings from media-handling processes such as file managers, thumbnailers, and media players
- Compare installed gst-plugins-good package versions against the fixed 1.28.6 release across the fleet
Monitoring Recommendations
- Collect application crash telemetry from Linux desktops running GNOME Files, Nautilus, or other GStreamer-backed previewers
- Alert on repeated abnormal terminations of processes that dynamically load libgstavi.so
- Track downloads of AVI files from email and web gateways for retrospective analysis if a patch is delayed
How to Mitigate CVE-2026-73433
Immediate Actions Required
- Upgrade gst-plugins-good to version 1.28.6 or later on all affected systems
- Apply distribution updates once vendors ship rebuilt packages; consult the Red Hat CVE-2026-73433 Advisory for enterprise Linux status
- Disable automatic AVI thumbnailing and preview features on multi-user hosts until patches are deployed
Patch Information
The upstream fix is included in gst-plugins-good 1.28.6, published as GStreamer Security Advisory SA-2026-0072. The corrective code is available in GitLab Merge Request #12231, which adds explicit length checks before decrementing the remaining-byte counter. Tracking for downstream Red Hat builds is available in Red Hat Bug Report #2514801.
Workarounds
- Remove or blacklist the avidemux element from GStreamer plugin registries where AVI playback is not required
- Block AVI files at email and web proxies for user populations that do not need the format
- Run media-processing workloads in sandboxed containers or under seccomp profiles to limit the impact of heap corruption
# Configuration example: block the avidemux element by removing the plugin file
sudo mv /usr/lib64/gstreamer-1.0/libgstavi.so /usr/lib64/gstreamer-1.0/libgstavi.so.disabled
# Verify avidemux is no longer registered
gst-inspect-1.0 avidemux || echo "avidemux element unavailable"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
