CVE-2026-73471 · Runtime
NO FIX YET · SEE WHAT TO DO
GStreamer's gst-plugins-good avidemux plugin dereferences a pointer in its Nikon metadata tag parser without checking that the data is still in the buffer. Opening or previewing a crafted AVI file, which playbin, decodebin and gst-discoverer load automatically, lets an attacker read memory out of bounds.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use GStreamer to open or preview AVI files, including through playbin, decodebin or gst-discoverer, are exposed when they handle files from untrusted sources. Systems that only play trusted media or do not run GStreamer-based software can skip it.
Who cares gst-plugins-good, gstreamer, media-players
1.28.6.1.28.6 or later (GStreamer-SA-2026-0072).A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.