Security Advisory 2026-0073 (CVE-2026-17072)
| Summary | Out-of-bounds read in Matroska demuxer FLAC header parser |
| Date | 2026-08-05 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.6 |
| IDs | GStreamer-SA-2026-0073 CVE-2026-17072 |
Details
An out-of-bounds read vulnerability in the FLAC stream header parser of the Matroska (MKV/WebM) demuxer in gst-plugins-good. When parsing FLAC codec private data from a track, the demuxer iterates over metadata blocks that consist of a 4-byte header followed by a variable-length payload. The bounds check before copying each block validated that the offset plus the payload length did not exceed the buffer size, but did not account for the additional 4 bytes of the block header included in the copy operation. A crafted file with a metadata block whose length field causes the block to end exactly at the buffer boundary passes the check but reads 4 bytes past the end of the codec private data buffer. Additionally, the loop condition for iterating over metadata blocks used an off-by-one threshold that allowed entering the loop body when fewer than 4 bytes remained, triggering a read of the block header beyond the buffer boundary.
Impact
A malicious third party could trigger an out-of-bounds read by providing a crafted Matroska or WebM file containing a FLAC audio track with a manipulated CodecPrivate element. This can result in a crash, denial of service, or information disclosure. Since the Matroska demuxer is auto-plugged by playbin, decodebin, and gst-discoverer pipelines, merely opening or previewing such a file is sufficient to trigger the vulnerability.
Solution
The gst-plugins-good 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.