Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft AVI with malicious VPRP chunk
  2. Delivery
    Deliver file to victim (email/web/upload)
  3. Exploit
    Victim opens file in GStreamer application
  4. Execution
    avidemux parses VPRP with inflated descriptor count
  5. Impact
    Out-of-bounds read triggers crash or memory disclosure

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the victim application uses GStreamer's avidemux plugin (part of gst-plugins-good) to parse an AVI file - specifically, a file containing a VPRP chunk with a crafted vprp->fields value. The attack is triggered through playbin or decodebin pipelines, which are the standard GStreamer entry points for generic media handling. User interaction is required: the victim must open, stream, or otherwise cause a GStreamer-based application to process the malicious AVI file (UI:R per CVSS). No authentication or special privilege is required on the attacker's side. Exploitation is limited to AVI files with a VPRP chunk; AVI files lacking this chunk are not affected. Server-side transcoding pipelines that automatically ingest AVI files from untrusted sources could be exploited without any human user interaction, reducing the effective UI:R barrier in those deployments.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) accurately reflects the attack profile: network-reachable via crafted media files, low complexity, no authentication required, but requiring user interaction (victim opens or streams the AVI). The high Availability impact aligns with the confirmed crash/DoS outcome; the Low Confidentiality impact acknowledges the potential for partial memory disclosure via the out-of-bounds read, though exploiting that for meaningful data exfiltration would be significantly harder. No EPSS score was provided in the source data, and the vulnerability does not appear on the CISA KEV list, suggesting exploitation has not been observed at scale in the wild. No POC code has been identified at time of analysis. Real-world priority is moderate: the DoS impact is reliable and low-bar to trigger (any user who opens a crafted AVI), while the information disclosure path is harder to weaponize. Organisations that expose GStreamer-based media processing to untrusted inputs - whether desktop users opening files from email, web-based media players, or transcoding pipelines ingesting uploaded content - face meaningful disruption risk. Patch availability (gst-plugins-good 1.28.6) is confirmed, making remediation straightforward for most deployments.
Exploit ScenarioDerived

An attacker hosts or emails a specially crafted AVI file with a manipulated VPRP chunk containing a vprp->fields value chosen to maximise the computed descriptor count. When a victim opens the file in any GStreamer-backed application (GNOME Videos, a web browser using GStreamer for media, a transcoding service), the avidemux parser reads past the end of the field-descriptor buffer, causing an immediate application crash. With additional effort, the attacker could tune the crafted file to cause the out-of-bounds read to return partial heap or stack memory in a diagnostic context, but no POC demonstrating data exfiltration has been identified.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 12, 2026

Out-of-bounds read in GStreamer's avidemux plugin (gst-plugins-good) allows a remote, unauthenticated attacker to crash media-processing applications and potentially leak memory contents by supplying a crafted AVI file. The flaw resides in gst_avi_demux_riff_parse_vprp(), where the count of video field descriptors is derived by dividing remaining buffer size by an attacker-controlled vprp->fields value rather than the struct size, causing the parser to treat more descriptors as valid than the buffer holds. User interaction is required to trigger the bug (the victim must open or stream the malicious AVI via playbin or decodebin), and the primary confirmed impact is denial of service; limited information disclosure is also possible. No public exploit or CISA KEV listing has been identified at time of analysis.

RemediationAI

The primary fix is upgrading gst-plugins-good to version 1.28.6 or later, per GStreamer-SA-2026-0072 (https://gstreamer.freedesktop.org/security/sa-2026-0072.html). The upstream merge request is tracked at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231. Red Hat Enterprise Linux users should apply the relevant RHEL errata once published, tracked at https://access.redhat.com/security/cve/CVE-2026-73434. As a compensating control where patching is not immediately possible, operators running server-side transcoding or media-ingestion pipelines can restrict acceptance of AVI files from untrusted sources at the application or network layer, or pre-validate AVI containers with a separate sanitiser before passing them to GStreamer; this does not eliminate risk for desktop users who open files directly. Disabling the avidemux GStreamer plugin (gst-plugins-good) entirely is possible but will break AVI playback broadly. There are no known side effects of applying the upstream patch.

Affected VersionsENISA

gst-plugins-good 0 <1.28.6

Affected Packages

euvd gst_plugins_good fix: 1.28.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is gst-plugins-good, the GStreamer plugin bundle that includes the avidemux element for parsing AVI container files. The specific flaw is in gst_avi_demux_riff_parse_vprp(), which processes the Video Properties (VPRP) chunk of AVI RIFF structures. The number of gst_riff_vprp_video_field_desc entries to iterate is computed as (remaining_buffer_size / vprp->fields) rather than (remaining_buffer_size / sizeof(gst_riff_vprp_video_field_desc)); because vprp->fields is attacker-controlled and can be set to a small value (e.g., 1), this inflates the computed entry count far beyond what the buffer actually contains. Subsequent loop iterations then read past the end of the allocated buffer - a classic CWE-125 (Out-of-bounds Read) condition. GStreamer's playbin and decodebin pipelines are common entry points, meaning any application relying on GStreamer for media handling (GNOME Videos, Rhythmbox, many embedded/IoT media players, browser media pipelines on Linux) is transitively affected. The fix is confirmed upstream in gst-plugins-good 1.28.6, referenced in GStreamer Security Advisory SA-2026-0072.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 6.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI 7.1 HIGH

Network-delivered crafted AVI, no auth needed, user must open file; DoS is primary impact with minor OOB-read confidentiality leak; no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat 6.1 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Aug 12, 2026 - 23:03 EUVD
Severity Changed
Aug 12, 2026 - 22:22 NVD
HIGH MEDIUM
CVSS changed
Aug 12, 2026 - 22:22 NVD
7.1 (HIGH) 6.1 (MEDIUM)
CVE Published
Aug 12, 2026 - 19:05 cve.org
HIGH 7.1

DescriptionCVE.org

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Executive ViewAI

Why It Matters

A buffer read vulnerability in GStreamer's AVI decoder (avidemux plugin in gst-plugins-good) enables denial-of-service attacks and possible memory disclosure when media-processing systems handle crafted video files. Organizations operating content delivery platforms, transcoding services, or video ingest pipelines face potential service disruption and data exposure if their infrastructure accepts untrusted AVI inputs. The vulnerability requires file access to trigger, reducing but not eliminating risk in open platforms.

Business Impact: High
Compensating Controls

Implement strict input validation and content-type verification for AVI files before GStreamer processing; containerize media workloads with memory limits and crash recovery to contain impact; apply network or application-layer controls to restrict AVI processing to trusted sources; disable avidemux plugin if not operationally essential; establish GStreamer security advisory monitoring to detect patch availability.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
GStreamer is the default media framework on most Linux desktops and many embedded platforms
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-73434 ADVISORY https://ubuntu.com/security/notices/USN-8863-1 ADVISORY https://vuldb.com/vuln/389256 REF https://access.redhat.com/errata/RHSA-2026:55434 REF https://access.redhat.com/errata/RHSA-2026:55436 REF https://access.redhat.com/errata/RHSA-2026:56966 REF https://access.redhat.com/errata/RHSA-2026:65959 REF https://access.redhat.com/errata/RHSA-2026:68642 REF https://access.redhat.com/errata/RHSA-2026:68644 REF https://access.redhat.com/errata/RHSA-2026:68645 REF https://access.redhat.com/errata/RHSA-2026:69232 REF https://access.redhat.com/errata/RHSA-2026:70264 REF https://access.redhat.com/errata/RHSA-2026:70584 REF https://access.redhat.com/errata/RHSA-2026:70803 REF https://access.redhat.com/security/cve/CVE-2026-73434 REF https://bugzilla.redhat.com/show_bug.cgi?id=2514807 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 REF https://gstreamer.freedesktop.org/security/sa-2026-0072.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy