Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-28T10:00:00 gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CWE-125

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as a victim must open a crafted Matroska or WebM media file. In practice, modern heap allocators align allocations such that the 4 overread bytes typically fall within adjacent allocated memory, making a crash unlikely in production builds. Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS 2 ship gstreamer1-plugins-good with the affected Matroska demuxer code path and are affected. Red Hat Enterprise Linux 7 ships gstreamer-plugins-good (GStreamer 0.10 era) which also contains the vulnerable function. Red Hat Enterprise Linux 6 ships an older gstreamer-plugins-good that also contains the affected code path. All RHEL and RHIVOS streams are deferred (low severity, low exploitability). Upstream acknowledges Yazan Balawneh (CyStack Security Team) as the original reporter. The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered: 1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build. 2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin. Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files. Red Hat Enterprise Linux 10 Fix deferred gstreamer1-plugins-good Red Hat Enterprise Linux 6 Will not fix gstreamer-plugins-good Red Hat Enterprise Linux 7 Will not fix gstreamer1-plugins-good Red Hat Enterprise Linux 7 Will not fix gstreamer-plugins-good Red Hat Enterprise Linux 8 Fix deferred gstreamer1-plugins-good Red Hat Enterprise Linux 9 Fix deferred gstreamer1-plugins-good https://www.cve.org/CVERecord?id=CVE-2026-17072 https://nvd.nist.gov/vuln/detail/CVE-2026-17072 https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/111