CVE-2026-73472 · Package
NO FIX YET · SEE WHAT TO DO
An integer overflow in the AVI superindex and subindex parsers of GStreamer's gst-plugins-good lets bounds checks be bypassed and memory be read out of bounds. Opening or previewing a crafted AVI file with playbin, decodebin or gst-discoverer is enough to trigger it.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use GStreamer to open or preview AVI files, including anything that relies on playbin, decodebin or gst-discoverer to process untrusted media, are exposed. Systems that never parse untrusted AVI files can skip it.
Not affected if no-untrusted-media
Who cares gstreamer, linux, media-playback
Unknown from the sources.
1.28.6 (GStreamer-SA-2026-0072)A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.