CVE-2026-73433: 
NixOS vulnerability analysis and mitigation

CVE-2026-73433 is an integer underflow (CWE-191) vulnerability in GStreamer's gst-plugins-good avidemux plugin that leads to heap out-of-bounds read and write when parsing FUJIFILM metadata in AVI files. The flaw was disclosed on August 12, 2026, and affects all versions of gst-plugins-good prior to 1.28.6, as well as Red Hat Enterprise Linux 7, 8, 9, and 10 shipping the affected package. It carries a CVSS v3.1 base score of 6.6 (Medium) per Red Hat and NVD (Red Hat CVE, GitHub Advisory).

The root cause is an integer underflow (CWE-191) in the gst_avi_demux_parse_strd() function within the avidemux element. When parsing FUJIFILM metadata from an AVI strd chunk, the function decrements a remaining-length counter by fixed offsets of 98 and then 10 bytes without first verifying that sufficient data remains in the buffer. For crafted strd payloads of exactly 106 or 107 bytes, this causes the unsigned counter to wrap around to a very large value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Additionally, date-format normalization logic may write beyond the buffer end, resulting in an out-of-bounds write. Exploitation requires only that a user open or preview a crafted AVI file, since the avidemux element is automatically invoked by GStreamer's playbin, decodebin, and gst-discoverer components. The upstream fix is tracked in GitLab merge request !12231 (Red Hat CVE, GStreamer Advisory).

Successful exploitation can result in heap out-of-bounds reads that disclose adjacent heap memory contents (including potentially sensitive data) through parsed metadata, heap out-of-bounds writes that corrupt memory, and application crash causing denial of service. In more severe scenarios, heap corruption from the out-of-bounds write could potentially be leveraged for arbitrary code execution in the context of the application processing the media file. The attack is local in vector and requires user interaction (opening a crafted AVI), limiting its scope, but any application using GStreamer's playbin, decodebin, or gst-discoverer — including media players and file managers with thumbnail preview — is affected (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.127% (3rd percentile), indicating a low near-term exploitation probability. NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact, further reducing immediate risk (GitHub Advisory). The vulnerability was reported by researcher Seonwook Kim (Red Hat CVE).

1. Craft a malicious AVI file: Create an AVI file containing a strd chunk with a FUJIFILM metadata signature and a payload of exactly 106 or 107 bytes in the stream format data, designed to trigger the integer underflow in gst_avi_demux_parse_strd().
2. Deliver the file to the target: Distribute the crafted AVI via email attachment, web download, shared network drive, or any other file delivery mechanism to a user on a system running a vulnerable version of gst-plugins-good.
3. Trigger automatic parsing: Induce the target user to open, preview, or otherwise process the file using any application that uses GStreamer's playbin, decodebin, or gst-discoverer (e.g., a media player, file manager with thumbnail generation, or media indexer).
4. Trigger integer underflow: When gst_avi_demux_parse_strd() processes the crafted strd chunk, the remaining-length counter underflows to a very large unsigned value after subtracting the fixed 98- and 10-byte offsets.
5. Achieve out-of-bounds read/write: The underflowed counter causes null-terminated string scanning to read far beyond the allocated heap buffer, potentially disclosing adjacent heap data. Date-format normalization may additionally write beyond the buffer, corrupting heap memory and potentially crashing the application or enabling further exploitation (Red Hat CVE, GStreamer Advisory).

• File System: Presence of unexpected or suspicious AVI files (particularly small files ~106–107 bytes in the strd chunk area) in download directories, temporary folders, or email attachment staging areas.
• Process: Unexpected crashes of media player processes (e.g., totem, rhythmbox, nautilus, gst-discoverer-1.0) with segmentation fault signals (SIGSEGV) or heap corruption errors referencing GStreamer avidemux components.
• Logs: Application crash logs or core dumps referencing gst_avi_demux_parse_strd in the stack trace; GStreamer debug output (e.g., GST_DEBUG=avidemux:5) showing anomalous remaining-length values during strd chunk parsing.
• System: Repeated application crashes triggered by opening specific AVI files, particularly those with FUJIFILM metadata markers in stream format chunks.

The upstream fix is available in gst-plugins-good version 1.28.6 (GStreamer-SA-2026-0072) (GStreamer Advisory). Red Hat has issued backported patches for its supported platforms: RHEL 10 via RHSA-2026:55434 (gstreamer1-plugins-good-1.26.7-2.el10_2.5), RHEL 9 via RHSA-2026:55436 (gstreamer1-plugins-good-1.22.12-7.el9_8.4), and RHEL 8 via RHSA-2026:56966 (RHSA-2026:55434, RHSA-2026:55436). As a workaround until patching is possible, restrict opening or previewing AVI files from untrusted sources, disable the avidemux plugin if not required, and avoid using playbin, decodebin, or gst-discoverer on untrusted AVI content.

Red Hat acknowledged the vulnerability and credited researcher Seonwook Kim for the report, issuing a Moderate severity rating and releasing patches for RHEL 7, 8, 9, and 10 within days of disclosure (Red Hat CVE). The GStreamer project published security advisory GStreamer-SA-2026-0072 and merged the upstream fix (GStreamer Advisory). Coverage was noted in Linux security roundup publications and vulnerability tracking platforms, though no significant broader media or social media discussion has been identified.