A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4837 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4837-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 15, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     Version        : 1.22.0-5+deb12u4     CVE ID         : CVE-2025-47183 CVE-2026-1940 CVE-2026-3083 CVE-2026-3085                      CVE-2026-17072 CVE-2026-18298 CVE-2026-18299 CVE-2026-39043                      CVE-2026-39044 CVE-2026-53705 CVE-2026-73433 CVE-2026-73434                      CVE-2026-88914

    Multiple vulnerabilities were discovered in gst-plugins-good1.0, a collection     of plugins for the GStreamer multimedia framework. Processing specially     crafted media files or RTP streams could result in denial of service,     disclosure of information or execution of arbitrary code.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.0-5+deb12u4.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur
    when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is
    triggered by a boundary check that does not account for the full size of the data being copied, allowing a
    small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious
    Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent
    heap memory. (CVE-2026-17072)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8863-1 advisory.

    Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2026-17072)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2026-73433)

    Seonwook Kim discovered that GStreamer Good Plugins did not correctly parse certain AVI files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-73434)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly handled certain closed caption data. An     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88914)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102691 advisory.

    A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory. (CVE-2026-17072)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366229	Debian dla-4837 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	Local	high
473624	Echo: gst-plugins-good1.0: security update to 1.26.2-1+e8	Tenable Cloud Security	Echo Local Security Checks	Local	low
473624	Echo: gst-plugins-good1.0: security update to 1.26.2-1+e8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362685	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Good Plugins vulnerabilities (USN-8863-1)	Nessus	Ubuntu Local Security Checks	Local	medium
338187	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-102691)	Nessus	Unity Linux Local Security Checks	Local	low
330400	Linux Distros Unpatched Vulnerability : CVE-2026-17072	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-17072

low

Tenable Plugins

high

low

low

medium

low

low