CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

This vulnerability is rated as Moderate impact because exploitation requires user interaction to process an untrusted media file and cannot be triggered remotely without direct user initiation. On Red Hat Enterprise Linux systems, the affected GStreamer demuxer plugin is invoked dynamically by desktop environments and media utilities when inspecting or rendering video containers. An attacker must trick a local user into opening or indexing a crafted AVI file, confining potential impact to an application crash or limited heap information leakage within the user's unprivileged session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.