Описание
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.28.7-1 |
| esm-infra-legacy/xenial | released | 1.8.3-1ubuntu0.5+esm4 |
| esm-infra/bionic | released | 1.14.5-0ubuntu1~18.04.3+esm4 |
| esm-infra/focal | released | 1.16.3-0ubuntu1.3+esm4 |
| jammy | released | 1.20.3-0ubuntu1.10 |
| noble | released | 1.24.2-1ubuntu1.8 |
| resolute | released | 1.28.2-2ubuntu0.4 |
| stonking | not-affected | 1.28.7-1 |
| upstream | released | 1.28.6-1 |
Показывать по
Ссылки на источники
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_ ...
EPSS
6.1 Medium
CVSS3