CVE-2026-73433

Name of the Vulnerable Software and Affected Versions gst-plugins-good versions prior to 1.28.6

Description A flaw exists in the avidemux element when parsing FUJIFILM metadata within an AVI strd chunk. The function gst avi demux parse strd() decrements a remaining-length counter by fixed offsets of 98 and 10 bytes without verifying if sufficient data remains. If a crafted strd payload is exactly 106 or 107 bytes, the counter underflows to a large unsigned value, leading to null-terminated string scanning that reads far beyond the allocated heap buffer. Additionally, date-format normalization may result in writing beyond the buffer end. This can lead to heap out-of-bounds read, out-of-bounds write, heap information disclosure where adjacent data appears in parsed metadata, and application crashes or denial of service. The issue can be triggered by opening or previewing a crafted AVI file, as the avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer.

Recommendations Update gst-plugins-good to version 1.28.6.