Description

A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-06T07:17:28.500Z",
  "pubdate": "2026-11-06T07:17:28.500Z",
  "executiveSummary": "A critical out-of-bounds (OOB) read vulnerability exists in the avidemux plugin within GStreamer gst-plugins-good. The flaw originates in the Nikon metadata tag parser, where improper boundary validation allows a pointer to be dereferenced beyond the allocated buffer limits.\nThis vulnerability is particularly severe because the avidemux plugin is automatically invoked by core GStreamer components, including playbin, decodebin, and gst-discoverer. An attacker can exploit this by enticing a victim to open or preview a specially crafted AVI file.\nSuccessful exploitation can result in memory disclosure or process instability, potentially leading to a denial-of-service (DoS) condition. As the parsing occurs within the context of the application utilizing GStreamer, the exploit requires no specific authentication or elevated privileges, provided the user interacts with the malicious media container. The issue is resolved in gst-plugins-good version 1.28.6 (GStreamer-SA-2026-0072).",
  "technicalDetails": "The vulnerability resides in the Nikon metadata parsing logic within the avidemux element of GStreamer's gst-plugins-good. The root cause is a failure to perform adequate bounds checking when processing metadata tags embedded within an AVI media container. Specifically, the parser fails to verify that the remaining buffer size is sufficient before proceeding with a pointer dereference operation. This lack of validation facilitates an out-of-bounds read, where the parser attempts to access memory addresses outside the intended buffer space.\nThe attack flow is initiated when a target application—such as a media player, browser, or thumbnail generator—utilizes GStreamer to process a malformed AVI file. Because avidemux is frequently auto-plugged via standard GStreamer pipelines (playbin, decodebin, gst-discoverer), the vulnerability is triggered implicitly upon the identification and parsing of the file's metadata tags. No active exploitation beyond opening or attempting to preview the file is required.\nTechnically, the parser logic processes specific tag identifiers found in the Nikon metadata structure. When a crafted AVI provides metadata values that deviate from expected length constraints or headers, the parser logic miscalculates the pointer offset relative to the data buffer. If the pointer arithmetic results in a memory address outside the scope of the allocated heap or stack buffer, the application proceeds to read adjacent memory segments. This leads to the ingestion of arbitrary data into the parsing logic, which may influence subsequent application execution flow or leak sensitive process information into the media stream metadata or crash the process entirely due to an access violation.\nGiven that this vulnerability affects the core parsing logic used by multiple high-level GStreamer abstractions, it presents a significant threat to any software relying on GStreamer for media handling. The vulnerability does not require prior authentication or specialized network access; rather, it is triggered at the application layer through the consumption of untrusted media files. The impact is primarily a high probability of process crashes, which can be leveraged for denial-of-service attacks on systems running affected GStreamer-based media processing software."
}