Description
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
Published: 2026-07-28
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A 4‑byte heap over‑read occurs in gst_matroska_parse_flac_stream_headers when processing FLAC headers inside Matroska or WebM container files. The boundary check fails to account for the full size of the data being copied, allowing a small read beyond the end of the allocated buffer. An attacker could craft a malicious file and trick a user into opening it, potentially leaking a few bytes of adjacent heap memory and exposing sensitive information.

Affected Systems

Vendors: Red Hat Enterprise Linux 6 through 10. Affected version information is not explicitly listed beyond the vendor list, so any installation of GStreamer‑plugins‑good on these RHEL releases is at risk.

Risk and Exploitability

CVSS score 3.3 indicates low severity and an EPSS score of < 1 % meaning exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Attack requires a user to open a malicious Matroska or WebM file processed by an application that loads GStreamer, so local user privileges may be sufficient. The read is only 4 bytes, limiting the amount of data that can be exposed, but it could still reveal small sensitive data.

Generated by OpenCVE AI on August 4, 2026 at 13:00 UTC.

Remediation

Vendor Workaround

The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered: 1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build. 2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin. Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.

OpenCVE Recommended Actions

  • Disable the matroska plugin in GStreamer, either at build time by passing -Dgst-plugins-good:matroska=disabled to the meson build system or at runtime by removing libgstmatroska from the plugin directory or setting GST_PLUGIN_PATH to a directory that excludes it.
  • Upgrade to a patched GStreamer release when one becomes available, then restart any media applications that rely on GStreamer.
  • If Matroska/WebM support is required before an update, configure your applications to use the plugin‑disabling workaround system‑wide or remove the libgstmatroska library from the shared library path until the update is applied.

Generated by OpenCVE AI on August 4, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Gstreamer
Gstreamer good Plug-ins
Vendors & Products Gstreamer
Gstreamer good Plug-ins

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
Title Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-125
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

threat_severity

Low

Subscriptions

Gstreamer Good Plug-ins
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-07-28T14:01:40.558Z

Reserved: 2026-07-24T14:10:44.899Z

Link: CVE-2026-17072

cve-icon Vulnrichment

Updated: 2026-07-28T14:01:33.231Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-28T11:17:02.433

Modified: 2026-07-28T16:22:01.443

Link: CVE-2026-17072

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-28T10:00:00Z

Links: CVE-2026-17072 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T13:15:03Z

Weaknesses