{"id":"CVE-2026-73471","kind":"vulnerability","aliases":["CVE-2026-73471"],"related":[],"title":"GStreamer: crafted AVI file triggers out-of-bounds read in Nikon metadata parser","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","summary":"GStreamer's gst-plugins-good avidemux plugin dereferences a pointer in its Nikon metadata tag parser without checking that the data is still in the buffer. Opening or previewing a crafted AVI file, which playbin, decodebin and gst-discoverer load automatically, lets an attacker read memory out of bounds.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-good","gstreamer","media-players","runtime"],"not_affected_if":[],"how_to_check":"- Check whether the installed gst-plugins-good version is below `1.28.6`.\n- Check whether your application uses GStreamer playbin, decodebin or gst-discoverer to open AVI files from untrusted sources.","fix":"- gst-plugins-good: move to `1.28.6` or later (GStreamer-SA-2026-0072).","status":"open","published_at":"2026-11-06T07:17:28+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","triaged_at":"2026-11-06T07:41:57+00:00","updated_at":"2026-11-06T07:41:57+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-06T07:41:57Z","model":"claude-haiku-5-5","output":{"fix":"- gst-plugins-good: move to `1.28.6` or later (GStreamer-SA-2026-0072).","reach":"local","title":"GStreamer: crafted AVI file triggers out-of-bounds read in Nikon metadata parser","impact":"medium","summary":"GStreamer's gst-plugins-good avidemux plugin dereferences a pointer in its Nikon metadata tag parser without checking that the data is still in the buffer. Opening or previewing a crafted AVI file, which playbin, decodebin and gst-discoverer load automatically, lets an attacker read memory out of bounds.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["gstreamer","gst-plugins-good","media-players"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Out-of-bounds memory read while previewing a crafted AVI file.","analyst_note":"","how_to_check":"- Check whether the installed gst-plugins-good version is below `1.28.6`.\n- Check whether your application uses GStreamer playbin, decodebin or gst-discoverer to open AVI files from untrusted sources.","plain_action":"","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Applications that use GStreamer to open or preview AVI files, including through playbin, decodebin or gst-discoverer, are exposed when they handle files from untrusted sources. Systems that only play trusted media or do not run GStreamer-based software can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001191,"input_tokens":4288,"output_tokens":1524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0072':154C '-2026':16A,19A '-73471':17A,20A '1.28.6':149C '2026':153C 'attack':75B 'auto':121C 'auto-plug':120C 'automat':72B 'avi':3A,62B,135C 'avidemux':36B,91C,118C 'bound':9A,80B,115C 'buffer':56B,110C 'caus':111C 'check':48B 'craft':2A,61B,134C 'cve':15A,18A 'data':51B,106C 'decodebin':66B,125C 'derefer':38B 'dereferenc':102C 'discover':70B,129C 'file':4A,63B 'fix':142C 'flaw':82C 'found':84C 'good':24B,35B,90C,148C 'gst':22B,33B,69B,88C,128C,146C 'gst-discover':68B,127C 'gst-plugins-good':21B,32B,87C,145C 'gstreamer':1A,25B,30B,86C,151C 'gstreamer-sa':150C 'issu':141C 'let':73B 'load':71B 'media':27B 'media-play':26B 'memori':77B 'metadata':13A,44B,95C 'nikon':12A,43B,94C 'open':57B,130C 'out-of-bound':6A,112C 'parser':14A,46B,97C 'playbin':65B,124C 'player':28B 'plug':122C 'plugin':23B,34B,37B,89C,147C 'pointer':40B,99C 'preview':59B,132C 'read':10A,76B,116C 'remain':107C 'runtim':29B 'sa':152C 'still':53B 'suffici':137C 'tag':45B,96C 'trigger':5A,139C 'upstream':143C 'verifi':104C 'without':47B,103C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer to open or preview AVI files, including through playbin, decodebin or gst-discoverer, are exposed when they handle files from untrusted sources. Systems that only play trusted media or do not run GStreamer-based software can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsgood","gstreamer","mediaplayers","medium","runtime"],"campaign_type":null,"search_a":"'-2026':16A,19A '-73471':17A,20A 'avi':3A 'bound':9A 'craft':2A 'cve':15A,18A 'file':4A 'gstreamer':1A 'metadata':13A 'nikon':12A 'out-of-bound':6A 'parser':14A 'read':10A 'trigger':5A","search_b":"'attack':75B 'automat':72B 'avi':62B 'avidemux':36B 'bound':80B 'buffer':56B 'check':48B 'craft':61B 'data':51B 'decodebin':66B 'derefer':38B 'discover':70B 'file':63B 'good':24B,35B 'gst':22B,33B,69B 'gst-discover':68B 'gst-plugins-good':21B,32B 'gstreamer':25B,30B 'let':73B 'load':71B 'media':27B 'media-play':26B 'memori':77B 'metadata':44B 'nikon':43B 'open':57B 'parser':46B 'playbin':65B 'player':28B 'plugin':23B,34B,37B 'pointer':40B 'preview':59B 'read':76B 'runtim':29B 'still':53B 'tag':45B 'without':47B","search_c":"'-0072':154C '1.28.6':149C '2026':153C 'auto':121C 'auto-plug':120C 'avi':135C 'avidemux':91C,118C 'bound':115C 'buffer':110C 'caus':111C 'craft':134C 'data':106C 'decodebin':125C 'dereferenc':102C 'discover':129C 'fix':142C 'flaw':82C 'found':84C 'good':90C,148C 'gst':88C,128C,146C 'gst-discover':127C 'gst-plugins-good':87C,145C 'gstreamer':86C,151C 'gstreamer-sa':150C 'issu':141C 'metadata':95C 'nikon':94C 'open':130C 'out-of-bound':112C 'parser':97C 'playbin':124C 'plug':122C 'plugin':89C,147C 'pointer':99C 'preview':132C 'read':116C 'remain':107C 'sa':152C 'suffici':137C 'tag':96C 'trigger':139C 'upstream':143C 'verifi':104C 'without':103C","first_public_at":"2026-11-06T07:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73471","severity":null,"published_at":"2026-11-06T07:17:28+00:00","modified_at":"2026-11-06T07:17:28+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","fetched_at":"2026-11-06T07:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}