Description

A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-11-06T07:17:40.917Z",
  "pubdate": "2026-11-06T07:17:40.917Z",
  "executiveSummary": "A critical vulnerability exists within the GStreamer gst-plugins-good suite, specifically within the avidemux component responsible for parsing AVI file formats.\nThe flaw stems from a lack of input validation during the processing of the subindex parser, allowing an attacker to manipulate the entry count field within a malicious AVI file.\nThis vulnerability leads to excessive memory allocation, culminating in a denial-of-service (DoS) condition. Because GStreamer's auto-plugging mechanisms (playbin, decodebin, and gst-discoverer) automatically utilize the avidemux plugin, the attack surface is significantly expanded.\nAn attacker can trigger this vulnerability simply by enticing a user to open, preview, or process a crafted AVI file through any application utilizing the vulnerable GStreamer plugins.\nThe risk implication is high, as it allows for trivial application crashes or system instability without requiring specialized privileges. No authentication is necessary, and the exploitation is silent, requiring only the ingestion of the malformed media container by the GStreamer framework.",
  "technicalDetails": "The vulnerability is localized within the subindex parsing logic of the avidemux plugin in gst-plugins-good. The root cause is an insufficient bounds-checking or validation mechanism for the entry count field extracted from the AVI container's index structures.\nIn the context of the AVI file format, subindexes facilitate efficient seeking and random access within the media stream. The parser reads an integer defining the number of entries present in the index. When this integer is not sanitized against physical file size constraints or maximum allowed memory thresholds, the parser proceeds to allocate memory based on the attacker-supplied value.\nBy providing an excessively high entry count value, an attacker can force the host process to request a massive heap allocation. This triggers an out-of-memory (OOM) condition or forces the operating system's memory management to reclaim resources aggressively, ultimately crashing the multimedia application or rendering it unresponsive. This is a classic integer-controlled allocation vulnerability leading to heap exhaustion.\nThe attack flow begins when an application (e.g., a media player or file indexer) invokes GStreamer to process an AVI file. If the application uses common pipeline elements such as playbin, decodebin, or gst-discoverer, the framework automatically probes available plugins and selects avidemux for format handling. As soon as the subindex parser encounters the malicious AVI atom, it processes the corrupted entry count field.\nThe impact is not limited to a single application; because GStreamer is a foundational multimedia framework, any software relying on it—including system-level thumbnails generators, web browsers with media support, or desktop media players—is potentially vulnerable. No authentication is required to trigger the payload, and the attacker does not need high-level privileges; the vulnerability is weaponized solely through the file ingestion process.\nThe vulnerability affects versions of gst-plugins-good prior to 1.28.6. Exploitation does not require network interaction if the user is presented with a local file, though network exposure is inherent if the media is fetched from a remote source via a URL. Post-exploitation, the primary impact is total service denial of the GStreamer pipeline, causing the host application to terminate unexpectedly due to an inability to service the fraudulent memory request."
}