{"id":"CVE-2026-73473","kind":"vulnerability","aliases":["CVE-2026-73473"],"related":[],"title":"GStreamer: crafted AVI file can exhaust memory and crash playback","description":"A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).","summary":"A missing check on the entry count in the AVI subindex parser of GStreamer's gst-plugins-good lets a crafted AVI file trigger excessive memory allocation. Opening or previewing such a file is enough, which causes a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-good","gstreamer","linux","media-pipelines","runtime"],"not_affected_if":["gst-plugins-good-1.28.6-or-later","no-untrusted-avi-input"],"how_to_check":null,"fix":"- gst-plugins-good: `1.28.6` (per GStreamer-SA-2026-0072 as cited in the description)","status":"open","published_at":"2026-11-06T07:17:40+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","triaged_at":"2026-11-06T07:41:56+00:00","updated_at":"2026-11-06T07:41:56+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T07:41:56Z","model":"claude-haiku-5-5","output":{"fix":"- gst-plugins-good: `1.28.6` (per GStreamer-SA-2026-0072 as cited in the description)","reach":"internet","title":"GStreamer: crafted AVI file can exhaust memory and crash playback","impact":"low","summary":"A missing check on the entry count in the AVI subindex parser of GStreamer's gst-plugins-good lets a crafted AVI file trigger excessive memory allocation. Opening or previewing such a file is enough, which causes a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gstreamer","gst-plugins-good","media-pipelines","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Denial of service through memory exhaustion while previewing a file","analyst_note":"","how_to_check":"- Check the installed gst-plugins-good version with `gst-inspect-1.0 --version` or your package manager; compare against the fixed release.\n- Look for the avidemux element in the plugin set your applications use (`gst-inspect-1.0 avidemux`).","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-avi-input","gst-plugins-good-1.28.6-or-later"],"who_is_affected":"Applications that use GStreamer to open, preview or index media, through playbin, decodebin or gst-discoverer, are exposed when they handle AVI files from untrusted sources. Systems that never parse untrusted AVI input can skip it. Versions before 1.28.6 are the affected range the description gives.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4271,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0072':136C '-2026':12A,15A '-73473':13A,16A '1.28.6':131C '2026':135C 'alloc':54B,94C 'auto':103C 'auto-plug':102C 'avi':3A,36B,49B,117C 'avidemux':79C,100C 'caus':64B,91C 'check':29B 'count':33B,89C 'craft':2A,48B,116C 'crash':9A 'cve':11A,14A 'decodebin':107C 'denial':66B,96C 'discover':111C 'enough':62B 'entri':32B,88C 'excess':52B,92C 'exhaust':6A 'file':4A,50B,60B 'fix':124C 'flaw':70C 'found':72C 'good':20B,45B,78C,130C 'gst':18B,43B,76C,110C,128C 'gst-discover':109C 'gst-plugins-good':17B,42B,75C,127C 'gstreamer':1A,21B,40B,74C,133C 'gstreamer-sa':132C 'issu':123C 'let':46B 'linux':22B 'media':24B 'media-pipelin':23B 'memori':7A,53B,93C 'miss':28B,84C 'open':55B,112C 'parser':38B,83C 'pipelin':25B 'playback':10A 'playbin':106C 'plug':104C 'plugin':19B,44B,77C,129C 'preview':57B,114C 'runtim':26B 'sa':134C 'servic':68B,98C 'subindex':37B,82C 'suffici':119C 'trigger':51B,121C 'upstream':125C 'valid':85C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer to open, preview or index media, through playbin, decodebin or gst-discoverer, are exposed when they handle AVI files from untrusted sources. Systems that never parse untrusted AVI input can skip it. Versions before 1.28.6 are the affected range the description gives.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsgood","gstreamer","linux","mediapipelines","medium","runtime"],"campaign_type":null,"search_a":"'-2026':12A,15A '-73473':13A,16A 'avi':3A 'craft':2A 'crash':9A 'cve':11A,14A 'exhaust':6A 'file':4A 'gstreamer':1A 'memori':7A 'playback':10A","search_b":"'alloc':54B 'avi':36B,49B 'caus':64B 'check':29B 'count':33B 'craft':48B 'denial':66B 'enough':62B 'entri':32B 'excess':52B 'file':50B,60B 'good':20B,45B 'gst':18B,43B 'gst-plugins-good':17B,42B 'gstreamer':21B,40B 'let':46B 'linux':22B 'media':24B 'media-pipelin':23B 'memori':53B 'miss':28B 'open':55B 'parser':38B 'pipelin':25B 'plugin':19B,44B 'preview':57B 'runtim':26B 'servic':68B 'subindex':37B 'trigger':51B","search_c":"'-0072':136C '1.28.6':131C '2026':135C 'alloc':94C 'auto':103C 'auto-plug':102C 'avi':117C 'avidemux':79C,100C 'caus':91C 'count':89C 'craft':116C 'decodebin':107C 'denial':96C 'discover':111C 'entri':88C 'excess':92C 'fix':124C 'flaw':70C 'found':72C 'good':78C,130C 'gst':76C,110C,128C 'gst-discover':109C 'gst-plugins-good':75C,127C 'gstreamer':74C,133C 'gstreamer-sa':132C 'issu':123C 'memori':93C 'miss':84C 'open':112C 'parser':83C 'playbin':106C 'plug':104C 'plugin':77C,129C 'preview':114C 'sa':134C 'servic':98C 'subindex':82C 'suffici':119C 'trigger':121C 'upstream':125C 'valid':85C","first_public_at":"2026-11-06T07:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73473","severity":null,"published_at":"2026-11-06T07:17:40+00:00","modified_at":"2026-11-06T07:17:40+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","fetched_at":"2026-11-06T07:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}