Security Advisory 2026-0073

Details

An out-of-bounds read vulnerability in the FLAC stream header parser of the Matroska (MKV/WebM) demuxer in gst-plugins-good. When parsing FLAC codec private data from a track, the demuxer iterates over metadata blocks that consist of a 4-byte header followed by a variable-length payload. The bounds check before copying each block validated that the offset plus the payload length did not exceed the buffer size, but did not account for the additional 4 bytes of the block header included in the copy operation. A crafted file with a metadata block whose length field causes the block to end exactly at the buffer boundary passes the check but reads 4 bytes past the end of the codec private data buffer. Additionally, the loop condition for iterating over metadata blocks used an off-by-one threshold that allowed entering the loop body when fewer than 4 bytes remained, triggering a read of the block header beyond the buffer boundary.

Impact

A malicious third party could trigger an out-of-bounds read by providing a crafted Matroska or WebM file containing a FLAC audio track with a manipulated CodecPrivate element. This can result in a crash, denial of service, or information disclosure. Since the Matroska demuxer is auto-plugged by playbin, decodebin, and gst-discoverer pipelines, merely opening or previewing such a file is sufficient to trigger the vulnerability.

Solution

The gst-plugins-good 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Good 1.28.6

Patches

• Patch