Description

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T20:17:56.943Z",
  "pubdate": "2026-08-12T20:17:56.943Z",
  "executiveSummary": "A vulnerability has been identified in the GStreamer gst-plugins-good package, specifically within the avidemux component. The flaw is classified as an out-of-bounds read vulnerability stemming from incorrect arithmetic when parsing Video Properties (vprp) headers in AVI files. An attacker can exploit this flaw by supplying a specially crafted AVI file processed via multimedia pipelines such as playbin or decodebin. Successful exploitation leads to an application crash, resulting in a denial of service (DoS). The attack requires user interaction or automated processing of untrusted media files, but does not necessitate authentication or specific privilege levels. The risk is constrained to application availability, as no remote code execution or arbitrary data disclosure is directly indicated by this specific flaw. The issue is resolved upstream in version 1.28.6 of gst-plugins-good.",
  "technicalDetails": "The root cause of the vulnerability resides in the function gst_avi_demux_riff_parse_vprp() within the gst-plugins-good avidemux plugin. During the parsing of RIFF AVI vprp structures, the application calculates the count of available gst_riff_vprp_video_field_desc entries. This calculation is performed incorrectly by dividing the remaining input buffer size by the attacker-controlled vprp->fields value, rather than performing the division by the actual memory structure size, sizeof(gst_riff_vprp_video_field_desc).\nBecause the vprp->fields value is fully controlled by the contents of the malicious AVI file, an attacker can manipulate this field to distort the boundary calculations. This causes the parser to logic-erroneously treat a significantly larger number of field descriptors as available than what physically fits within the allocated input buffer boundaries. As the parsing loop iterates based on this erroneous count, subsequent memory read operations access data beyond the bounds of the valid buffer, triggering an out-of-bounds read.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious AVI file containing a manipulated vprp chunk with a carefully chosen fields value. Second, the victim application ingests this file using GStreamer media loading mechanisms, utilizing components like playbin or decodebin which instantiate the vulnerable avidemux element. Third, as the demuxer enters gst_avi_demux_riff_parse_vprp() to parse the RIFF stream, the flawed division logic executes. Finally, the parsing logic attempts to read structures past the buffer limits, resulting in a segmentation fault or memory access violation that crashes the host process, achieving a denial of service.\nThe vulnerable component is the gst_avi_demux_riff_parse_vprp() function in gst-plugins-good (avidemux). Affected versions include releases prior to 1.28.6. The vulnerability requires no authentication or special privileges, but depends on local or network processing of untrusted file payloads. Remediation requires applying the upstream patch provided in GStreamer-SA-2026-0072."
}