CVE-2026-73433 Integer overflow in Red Hat Enterprise Linux 10
An attacker can cause heap out-of-bounds read/write and application crash by tricking a user into opening a crafted AVI file with GStreamer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73433?
CVE-2026-73433 is a medium-severity vulnerability in Gstreamer Gstreamer, published on 12 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Weakness: CWE-191
Which versions are affected by CVE-2026-73433?
It affects 2 products.
Products include Gstreamer Gstreamer, Redhat Enterprise Linux.
How do I fix CVE-2026-73433?
Upgrade to a fixed version.
Is CVE-2026-73433 being exploited?
There is no known exploitation of CVE-2026-73433 in the wild and no public exploit code.
Other vulnerabilities in Gstreamer Gstreamer
- CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-37328 GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-37329 GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability
Sources
Also known as DEBIAN-CVE-2026-73433, ECHO-0929-81ea-1686, GHSA-cq86-v72j-qxrj, MINI-g8qx-q29m-9rcj, UBUNTU-CVE-2026-73433.