CVE-2026-73434: 
NixOS vulnerability analysis and mitigation

CVE-2026-73434 is an out-of-bounds read vulnerability in GStreamer's gst-plugins-good (avidemux plugin) affecting all versions prior to 1.28.6. The flaw exists in the gst_avi_demux_riff_parse_vprp() function, where the number of available gst_riff_vprp_video_field_desc entries is incorrectly calculated using an attacker-controlled vprp->fields value instead of sizeof(gst_riff_vprp_video_field_desc), enabling out-of-bounds memory reads. It was disclosed on August 12, 2026, and fixed upstream as GStreamer-SA-2026-0072. Red Hat rates this vulnerability with a CVSS v3.1 base score of 6.1 (Medium), while the GitHub Advisory Database assigns a score of 7.1 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). In gst_avi_demux_riff_parse_vprp(), the parser divides the remaining buffer size by the attacker-controlled vprp->fields value to determine how many gst_riff_vprp_video_field_desc structures are available, rather than dividing by sizeof(gst_riff_vprp_video_field_desc). This logic error allows the parser to believe more field descriptors fit in the buffer than actually do, causing it to read memory beyond the buffer boundary. Exploitation requires a user to open a specially crafted AVI file via GStreamer's playbin or decodebin pipeline elements, making user interaction a prerequisite. The upstream fix is tracked in GStreamer merge request !12231 (Red Hat CVE, Github Advisory).

Successful exploitation causes the application processing the malicious AVI file to crash, resulting in a denial of service. Additionally, the out-of-bounds read may expose limited amounts of process memory, creating a low-severity confidentiality risk — for example, leaking memory addresses that could assist in bypassing ASLR or other memory protection mechanisms. There is no integrity impact, and lateral movement potential is limited given the local attack vector and requirement for user interaction (Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.127%, placing it in the 3rd percentile for exploitation likelihood within 30 days. Exploitation is not automatable, as it requires a user to interact with a crafted AVI file (Github Advisory).

1. Craft a malicious AVI file: Create an AVI file with a VPRP (Video Properties) chunk where the fields value is set to a small integer (e.g., 1) that, when used as a divisor against the remaining buffer size, yields a count of field descriptors larger than what actually fits in the buffer.
2. Deliver the file to the target: Distribute the crafted AVI via email attachment, web download, shared network drive, or any other means to induce the target user to open it.
3. Trigger parsing via GStreamer: The victim opens the file using a GStreamer-based media player (e.g., Totem, Rhythmbox, or any application using playbin/decodebin), which invokes the gst_avi_demux_riff_parse_vprp() function.
4. Out-of-bounds read occurs: The parser reads beyond the allocated buffer for gst_riff_vprp_video_field_desc entries, accessing unintended memory regions.
5. Application crash (DoS): The invalid memory access triggers a segmentation fault, crashing the media player and achieving denial of service. Memory contents read out-of-bounds may also be observable in crash dumps, potentially leaking sensitive data (Red Hat CVE, Github Advisory).

• Process: Unexpected crash or segmentation fault of a GStreamer-based media player process (e.g., totem, gst-launch-1.0) shortly after opening an AVI file.
• Logs: System logs (e.g., /var/log/messages, journalctl) showing a segfault signal for a GStreamer process; GStreamer debug output (GST_DEBUG) indicating errors in gst_avi_demux_riff_parse_vprp() or RIFF parsing.
• File System: Presence of unexpected or suspicious AVI files in download directories, temporary folders, or email attachment staging areas.
• Core Dumps: Core dump files generated by crashed GStreamer processes, potentially containing out-of-bounds memory contents.

The primary remediation is to upgrade gst-plugins-good to version 1.28.6 or later upstream (Github Advisory). Red Hat has issued backported fixes for its distributions: RHEL 10 users should apply gstreamer1-plugins-good-1.26.7-2.el10_2.5 via RHSA-2026:55434, RHEL 9 users should apply gstreamer1-plugins-good-1.22.12-7.el9_8.4 via RHSA-2026:55436, and RHEL 8 users should apply the fix via RHSA-2026:56966 (RHSA-2026:55434, RHSA-2026:55436). As a workaround prior to patching, restrict processing of AVI files from untrusted sources and avoid opening media files from unknown origins with GStreamer-based applications.

Red Hat acknowledged the vulnerability and credited researcher Seonwook Kim for the report, issuing a Moderate-severity advisory across RHEL 7, 8, 9, and 10 (Red Hat CVE). No significant broader community discussion or notable researcher commentary beyond the vendor advisory has been identified at this time.