Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

Summary

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Timeline

1. Aug 12, 2026, 7:05 PM UTCCVE published
2. Aug 13, 2026, 12:27 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 23, 2026, 3:06 PM UTCRecord last updated

Affected versions

• gst-plugins-good

  fixed in 1.28.6

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

• gstreamer1-plugins-good

  Version range not reported

References 15