CVE-2026-73434: GStreamer gst-plugins-good DoS Vulnerability

CVE-2026-73434 Overview

CVE-2026-73434 is an out-of-bounds read vulnerability in GStreamer's gst-plugins-good package, specifically in the AVI demuxer component. The flaw resides in the gst_avi_demux_riff_parse_vprp() function, which incorrectly computes the number of available gst_riff_vprp_video_field_desc entries. The parser divides the remaining buffer size by an attacker-controlled vprp->fields value instead of sizeof(gst_riff_vprp_video_field_desc). Processing a crafted AVI file through playbin or decodebin triggers out-of-bounds reads that crash the media pipeline. The issue is tracked as GStreamer Security Advisory SA-2026-0072 and is fixed in gst-plugins-good 1.28.6.

Critical Impact
A crafted AVI file processed by an application using GStreamer's AVI demuxer can crash the host process, producing a denial-of-service condition and potentially exposing adjacent heap memory contents via out-of-bounds reads.

Affected Products

GStreamer gst-plugins-good versions prior to 1.28.6
Applications embedding GStreamer AVI demuxing via playbin or decodebin
Linux distributions shipping vulnerable gst-plugins-good packages (see Red Hat advisory)

Discovery Timeline

2026-08-12 - CVE-2026-73434 published to NVD
2026-08-12 - Last updated in NVD database
Upstream fix - Released in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072)

Technical Details for CVE-2026-73434

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the AVI demuxer of gst-plugins-good. GStreamer parses the vprp (video properties) RIFF chunk to extract per-field video descriptors. The parser must determine how many gst_riff_vprp_video_field_desc structures fit within the remaining buffer before iterating over them.

Instead of computing capacity using the fixed structure size, the code divides the remaining buffer length by vprp->fields, a value taken directly from the untrusted input file. When an attacker supplies a small fields value, the computation yields a bounded count that exceeds the actual number of complete descriptors present in the buffer. The demuxer then iterates past the end of the input, reading unrelated heap memory.

The practical consequence is a process crash of any application chaining decodebin or playbin against the file. Because the read extends into adjacent memory, sensitive process data may be interpreted as descriptor fields before the crash occurs.

Root Cause

The root cause is incorrect bounds arithmetic in gst_avi_demux_riff_parse_vprp(). The available-entry count should be remaining_size / sizeof(gst_riff_vprp_video_field_desc). The vulnerable code instead uses remaining_size / vprp->fields, conflating a count field with an element size. This violates the invariant that iteration bounds must be derived from trusted structural constants, not attacker-controlled header values.

Attack Vector

Exploitation requires an attacker to deliver a crafted AVI file to a target that opens the file with a GStreamer-based media pipeline. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H reflects local delivery with required user interaction, such as opening a file in a media player, thumbnailer, or file manager preview backed by GStreamer. No authentication is required. Successful processing triggers the out-of-bounds read and terminates the pipeline process.

No verified public exploit code is available for CVE-2026-73434. See the GStreamer Security Advisory SA-2026-0072 and the upstream fix in GStreamer Merge Request #12231 for authoritative technical detail.

Detection Methods for CVE-2026-73434

Indicators of Compromise

Repeated crashes of processes such as gst-launch-1.0, totem, rhythmbox, nautilus, or tracker-extract when handling AVI files
Core dumps referencing gst_avi_demux_riff_parse_vprp in the crashing stack frame
AVI files containing malformed vprp chunks with anomalously small fields values relative to chunk size

Detection Strategies

Inventory installed gst-plugins-good versions across Linux endpoints and flag any version below 1.28.6
Monitor process termination events for GStreamer-based media handlers correlated with recently opened AVI content
Inspect crash reporting telemetry (systemd-coredump, abrt) for signatures involving the AVI demuxer

Monitoring Recommendations

Ingest package inventory and process crash telemetry into a centralized analytics platform for correlation
Alert when media pipeline processes crash shortly after file open events from email or web download sources
Track distribution security advisories referencing GStreamer-SA-2026-0072 to confirm patch availability per platform

How to Mitigate CVE-2026-73434

Immediate Actions Required

Update gst-plugins-good to version 1.28.6 or later on all affected systems
Apply vendor-provided backports from distribution security channels where 1.28.6 is not yet packaged
Restrict automatic AVI processing in file managers, thumbnailers, and mail clients until patches are deployed

Patch Information

The upstream fix is included in gst-plugins-good 1.28.6, delivered under GStreamer Security Advisory SA-2026-0072. The corrected code computes iteration bounds using sizeof(gst_riff_vprp_video_field_desc). Distribution-specific patches are tracked in the Red Hat CVE-2026-73434 advisory and Red Hat Bug Report #2514807.

Workarounds

Disable or unregister the AVI demuxer element where AVI support is not required
Block delivery of AVI attachments at mail and web proxy gateways until patching completes
Configure thumbnailers and indexers (for example, tracker-extract) to skip AVI files pending remediation

bash

# Verify installed gst-plugins-good version and update on Red Hat based systems
rpm -q gstreamer1-plugins-good
sudo dnf update gstreamer1-plugins-good

# Verify installed gst-plugins-good version and update on Debian based systems
dpkg -l | grep gstreamer1.0-plugins-good
sudo apt update && sudo apt install --only-upgrade gstreamer1.0-plugins-good