CVE-2026-73434

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires a user to open a specially crafted AVI file, and the resulting out-of-bounds read primarily causes an application crash rather than arbitrary code execution. GStreamer is utilized across desktop and multimedia workflows to handle media playback, meaning automated services or server environments are generally unaffected unless explicitly configured to parse external media streams. A successful attack relies on convincing a user to process malicious media, limiting the risk to the privileges of the active application without compromising system-level integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.