Description

A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-12T20:17:56.810Z",
  "pubdate": "2026-08-12T20:17:56.810Z",
  "executiveSummary": "A critical vulnerability exists in the GStreamer gst-plugins-good avidemux component during the parsing of FUJIFILM metadata within AVI strd chunks. Classified primarily as an integer underflow leading to out-of-bounds memory operations, this flaw allows an unauthenticated attacker to trigger heap out-of-bounds reads and writes, heap information disclosure, and application denial of service. The affected product is GStreamer gst-plugins-good, specifically prior to version 1.28.6. Risk implications are severe because the vulnerable avidemux element is automatically invoked by core pipeline components such as playbin, decodebin, and gst-discoverer. Consequently, simple user interaction—such as opening, previewing, or scanning a maliciously crafted AVI file—is sufficient to trigger exploitation without requiring specialized privileges or network exposure.",
  "technicalDetails": "The root cause of the vulnerability resides in the function gst_avi_demux_parse_strd() within the AVI demuxer implementation of gst-plugins-good. When processing FUJIFILM metadata embedded inside an AVI strd chunk, the parser decrements a remaining-length counter by fixed offsets of 98 and 10 bytes. However, the function fails to validate whether sufficient data actually remains in the input buffer before performing these decrement operations. For specially crafted strd payloads with an exact length of 106 or 107 bytes, the remaining-length counter underflows, wrapping around to a massive unsigned integer value.\nThe attack flow proceeds as follows: an attacker delivers a maliciously crafted AVI file containing the targeted strd payload. When a victim or an automated media indexing service processes the file via GStreamer, the avidemux element parses the AVI structure and invokes gst_avi_demux_parse_strd(). Upon processing the crafted payload, the unchecked byte offsets trigger the integer underflow on the remaining-length counter.\nBecause the counter becomes an excessively large unsigned value, subsequent parsing routines—including null-terminated string scanning operations and date-format normalization procedures—miscalculate buffer boundaries. This causes the scanning logic to read far beyond the boundaries of the allocated heap buffer, leading to heap out-of-bounds reads that can leak adjacent heap memory contents (heap information disclosure). Furthermore, subsequent write operations during date-format normalization result in heap out-of-bounds writes, corrupting adjacent heap memory structures. This memory corruption typically culminates in an application crash, resulting in a denial of service, or potentially facilitating arbitrary code execution depending on heap layout and allocator state.\nThe vulnerability requires no authentication or privileges, as it is triggered locally by parsing untrusted media files. The attack vector is local media ingestion, but the automatic auto-plugging behavior of playbin, decodebin, and gst-discoverer significantly broadens the attack surface by exposing media player applications and backend transcoding services to malicious payloads embedded in standard media containers."
}