CVE-2026-73473
Description
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
Statement
This vulnerability is rated as having a Moderate severity because exploitation requires a local user to process or preview an untrusted media file, with the impact limited to a crash or process termination due to memory exhaustion. In standard Red Hat Enterprise Linux desktop environments, applications leveraging GStreamer frameworks (such as media players or file managers generating thumbnails) automatically invoke the affected demuxer when parsing AVI files. Core enterprise server installations typically do not process untrusted multimedia streams by default, which restricts overall operational exposure.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Acknowledgements
Red Hat would like to thank Seonwook Kim for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
