Description

A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-06T07:17:34.083Z",
  "pubdate": "2026-11-06T07:17:34.083Z",
  "executiveSummary": "A critical integer overflow vulnerability exists within the avidemux plugin of GStreamer gst-plugins-good, specifically residing in the superindex and subindex parsers.\nThe flaw allows an attacker to bypass critical bounds checking mechanisms during the parsing of malformed AVI files, leading to out-of-bounds (OOB) memory reads.\nBecause the avidemux plugin is automatically invoked by high-level GStreamer elements such as playbin, decodebin, and gst-discoverer, the vulnerability presents a significant attack surface.\nAn attacker can trigger this vulnerability simply by enticing a user to open, preview, or process a specially crafted AVI file.\nThe primary risk involves unauthorized memory access, which could lead to application crashes (Denial of Service) or potentially facilitate information disclosure, depending on the memory layout and surrounding process state.\nNo authentication or elevated privileges are required for exploitation, as the vulnerability is triggered during the standard media parsing pipeline.",
  "technicalDetails": "The root cause of this vulnerability lies in improper input validation within the avidemux parser's handling of AVI index structures. Specifically, the superindex and subindex parsing logic fails to account for integer overflows when calculating memory offsets or buffer sizes derived from untrusted metadata fields within the AVI file format.\nWhen the parser processes these fields, an integer overflow occurs, resulting in an incorrect size calculation. This value is subsequently used to perform bounds checks. Because the overflow results in a wrapped, smaller-than-intended value, the bounds check is rendered ineffective, allowing the parser to proceed as if the operation were safe.\nThe exploitation flow initiates when a GStreamer-based application uses playbin, decodebin, or gst-discoverer to ingest a malicious media file. Upon loading the file, the avidemux plugin is auto-plugged into the pipeline. The parser attempts to read the superindex or subindex structures to identify media streams and frame locations.\nThe malicious file provides crafted values that trigger the integer overflow during these index parsing routines. Once the bounds checks are bypassed, the subsequent read operations reference memory addresses outside the legitimate bounds of the allocated buffer. This triggers an out-of-bounds read, enabling the attacker to read sensitive data residing in the application's address space or, more commonly, trigger a segmentation fault that crashes the media processing pipeline.\nAffected versions include all versions of gst-plugins-good prior to 1.28.6. The issue is categorized under the context of GStreamer-SA-2026-0072. The vulnerability does not require any specific network exposure, as it is triggered locally by the processing of the file; however, it is highly dangerous in any environment where automated thumbnailing, media previewing, or transcoding services process external AVI files.\nFrom a post-exploitation perspective, the primary impact is a Denial of Service via application termination. While OOB reads typically result in crashes, they also serve as a primitive for memory disclosure. If the surrounding heap memory contains sensitive application state, such as pointers or cryptographic keys, an attacker may leverage this memory access to gain information that facilitates further exploitation in more complex attack scenarios."
}