Skip to content
Advisories.
Red HatCVE-2026-73434

Red Hat gst-plugins-good: denial of service

Medium6.1CVE-2026-73434 · Published Aug 12, 2026 · updated Sep 23, 2026

A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Red Hat advisory

Affected versions

PackageAffectedFixed in
gst-plugins-good
Product
< 1.28.61.28.6
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-125

More Red Hat advisories

All Red Hat
Advisory
Red Hat: mass assignment
High8.5Aug 12
Red Hat insights-client. The: excessive privileges
Medium6.5Aug 12
Red Hat search-v2-api: denial of service
High7.5Aug 12
Red Hat acm-search-v2-rhel9: remote code execution
Critical9.0Aug 12
Red Hat open-iscsi. This vulnerability: denial of service
Medium6.5Aug 12
Red Hat open-iscsi: integer overflow
Medium6.5Aug 12

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.