{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-73433", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-12T16:14:17.474Z", "datePublished": "2026-08-12T19:05:27.296Z", "dateUpdated": "2026-08-19T20:54:30.326Z" }, "containers": { "cna": { "title": "Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write", "metrics": [ { "other": { "content": { "value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072)." } ], "affected": [ { "vendor": "GStreamer", "product": "gst-plugins-good", "versions": [ { "status": "affected", "version": "0", "lessThan": "1.28.6", "versionType": "semver" } ], "packageName": "gst-plugins-good", "collectionURL": "https://gitlab.freedesktop.org/gstreamer/gst-plugins-good", "defaultStatus": "unaffected" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-good", "defaultStatus": "affected", "versions": [ { "version": "0:1.26.7-2.el10_2.5", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:enterprise_linux:10.2" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-good", "defaultStatus": "affected", "versions": [ { "version": "0:1.16.1-7.el8_10.3", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-good", "defaultStatus": "affected", "versions": [ { "version": "0:1.22.12-7.el9_8.4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "gstreamer1-plugins-good", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ] } ], "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:55434", "name": "RHSA-2026:55434", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:55436", "name": "RHSA-2026:55436", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:56966", "name": "RHSA-2026:56966", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-73433", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514801", "name": "RHBZ#2514801", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231" }, { "url": "https://gstreamer.freedesktop.org/security/sa-2026-0072.html" } ], "datePublic": "2026-08-05T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-191", "description": "Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-191: Integer Underflow (Wrap or Wraparound)", "timeline": [ { "lang": "en", "time": "2026-08-12T15:57:36.499Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Seonwook Kim for reporting this issue." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-08-19T20:54:30.326Z" }, "x_generator": { "engine": "cvelib 1.8.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-08-14T21:57:51.529936Z", "id": "CVE-2026-73433", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T21:58:00.425Z" } } ] } }