CVE-2026-73433 GStreamer CVE debrief

Who should care

Users and administrators of GStreamer gst-plugins-good, particularly those using the avidemux element, should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. GStreamer users should prioritize patching to prevent potential heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service attacks. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. Asset inventory and source tracking should be performed to identify potential exposure. Rollback/change windows should be considered for remediation. Vulnerability management and security teams should track this vulnerability and verify patches or mitigations are applied. Managed environments should be reviewed for affected product deployments and an owner assigned for follow-up. Security teams should verify that monitoring and detection systems are in place to identify potential exploitation attempts. Compensating controls should be implemented for exposed systems while remediation is scheduled. GStreamer installations should be inventoried for potential exposure. Security teams should review CVE and NVD records for updates and verify patches or mitigations are applied. Security teams should also verify that asset inventory and source tracking are performed to identify potential exposure. Security teams should verify compensating controls are implemented for exposed systems while remediation is scheduled and verified. Security teams should verify that exceptions, retested remediated assets, and closed items are tracked only after evidence is documented. Security teams should verify that rollback/change are

Technical summary

The avidemux element in GStreamer gst-plugins-good has a flaw when parsing FUJIFILM metadata in an AVI strd chunk. The gst_avi_demux_parse_strd() function decrements a remaining-length counter by fixed offsets without verifying sufficient data remains, leading to potential heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service. The vulnerability can be triggered by opening or previewing a crafted AVI file.

Defensive priority

GStreamer users should prioritize patching to prevent potential heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service attacks.

Recommended defensive actions

• Apply patches from gst-plugins-good 1.28.6 or later
• Restrict access to crafted AVI files
• Monitor for suspicious AVI file activity
• Inventory GStreamer installations for potential exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The flaw in GStreamer gst-plugins-good (avidemux) allows for heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service when parsing FUJIFILM metadata in an AVI strd chunk. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure, and application crash/denial of service.

Official resources