A vulnerability was identified in the avidemux component of the GStreamer gst-plugins-good project. The flaw occurs while parsing FUJIFILM metadata inside an AVI strd chunk. The parser decreases a remaining-length counter by fixed offsets without first checking that the requested bytes remain in the buffer. For crafted payloads that are exactly 106 or 107 bytes long, the counter underflows to an astronomically large value. Subsequent null-terminated string scanning then reads far beyond the allocated heap buffer, and a subsequent normalization step can write past the buffer end. These actions trigger heap out-of-bounds read and write operations, which can expose adjacent memory contents as parsed metadata and may cause the application to crash or become unresponsive. The affected element is automatically loaded by common pipelines such as playbin, decodebin, and gst-discoverer, so simply opening or previewing a malicious AVI file is sufficient to trigger the issue.

The flaw affects the GStreamer gst-plugins-good package, specifically the avidemux plugin, and is present in Red Hat Enterprise Linux releases 7, 8, 9, and 10. Red Hat packages that incorporate GStreamer versions earlier than 1.28.6 contain the vulnerability. A fix was introduced upstream in gst-plugins-good 1.28.6, and Red Hat has included this update in the 10, 9, 8, and 7 distribution packages as part of the 1.28.6 update.

The CVSS score for this vulnerability is 6.6, indicating a medium level of severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a user or an application that loads a specially crafted AVI file through GStreamer’s playbin, decodebin, or gst-discoverer components. An attacker who can supply such a file can achieve a memory read/write that may lead to information disclosure or a local denial of service. No remote exploitation path is explicitly documented, so the risk is constrained to environments that accept or process user media files.