CVE-2026-73473 · Runtime
NO FIX YET · SEE WHAT TO DO
A missing check on the entry count in the AVI subindex parser of GStreamer's gst-plugins-good lets a crafted AVI file trigger excessive memory allocation. Opening or previewing such a file is enough, which causes a denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use GStreamer to open, preview or index media, through playbin, decodebin or gst-discoverer, are exposed when they handle AVI files from untrusted sources. Systems that never parse untrusted AVI input can skip it. Versions before 1.28.6 are the affected range the description gives.
Not affected if gst-plugins-good-1.28.6-or-later, no-untrusted-avi-input
Who cares gst-plugins-good, gstreamer, linux, media-pipelines
Unknown from the sources.
1.28.6 (per GStreamer-SA-2026-0072 as cited in the description)A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.