CVE-2026-17072

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as a victim must open a crafted Matroska or WebM media file. In practice, modern heap allocators align allocations such that the 4 overread bytes typically fall within adjacent allocated memory, making a crash unlikely in production builds.

Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS 2 ship gstreamer1-plugins-good with the affected Matroska demuxer code path and are affected. Red Hat Enterprise Linux 7 ships gstreamer-plugins-good (GStreamer 0.10 era) which also contains the vulnerable function. Red Hat Enterprise Linux 6 ships an older gstreamer-plugins-good that also contains the affected code path. All RHEL and RHIVOS streams are deferred (low severity, low exploitability).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered:

1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build.
2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin.

Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.