A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3276 advisory.

    A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory. (CVE-2026-17072)

    A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd     chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes)     without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the     counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to     read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end.
    Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure     (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux     element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI     is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
    (CVE-2026-73433)

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number     of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by     the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This     can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting     in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial     of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4023 advisory.

    A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory. (CVE-2026-17072)

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number     of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by     the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This     can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting     in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial     of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4024 advisory.

    A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory. (CVE-2026-17072)

    A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd     chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes)     without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the     counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to     read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end.
    Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure     (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux     element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI     is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
    (CVE-2026-73433)

    A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number     of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by     the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This     can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting     in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial     of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). (CVE-2026-73434)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4837 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4837-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     October 15, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gst-plugins-good1.0     Version        : 1.22.0-5+deb12u4     CVE ID         : CVE-2025-47183 CVE-2026-1940 CVE-2026-3083 CVE-2026-3085                      CVE-2026-17072 CVE-2026-18298 CVE-2026-18299 CVE-2026-39043                      CVE-2026-39044 CVE-2026-53705 CVE-2026-73433 CVE-2026-73434                      CVE-2026-88914

    Multiple vulnerabilities were discovered in gst-plugins-good1.0, a collection     of plugins for the GStreamer multimedia framework. Processing specially     crafted media files or RTP streams could result in denial of service,     disclosure of information or execution of arbitrary code.

    For Debian 12 bookworm, these problems have been fixed in version     1.22.0-5+deb12u4.

    We recommend that you upgrade your gst-plugins-good1.0 packages.

    For the detailed security status of gst-plugins-good1.0 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gst-plugins-good1.0

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur
    when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is
    triggered by a boundary check that does not account for the full size of the data being copied, allowing a
    small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious
    Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent
    heap memory. (CVE-2026-17072)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8863-1 advisory.

    Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2026-17072)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files. An attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2026-73433)

    Seonwook Kim discovered that GStreamer Good Plugins did not correctly parse certain AVI files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-73434)

    Seonwook Kim discovered that GStreamer Good Plugins incorrectly handled certain closed caption data. An     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88914)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102691 advisory.

    A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur     when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is     triggered by a boundary check that does not account for the full size of the data being copied, allowing a     small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious     Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent     heap memory. (CVE-2026-17072)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371881	Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-3276)	Nessus	Amazon Linux Local Security Checks	Local	medium
371771	Amazon Linux 2 : gstreamer-plugins-good (ALAS-2026-4023)	Nessus	Amazon Linux Local Security Checks	Local	medium
371752	Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2026-4024)	Nessus	Amazon Linux Local Security Checks	Local	medium
366229	Debian dla-4837 : gstreamer1.0-gtk3 - security update	Nessus	Debian Local Security Checks	Local	high
473624	Echo: gst-plugins-good1.0: security update to 1.26.2-1+e8	Tenable Cloud Security	Echo Local Security Checks	Local	low
473624	Echo: gst-plugins-good1.0: security update to 1.26.2-1+e8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362685	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Good Plugins vulnerabilities (USN-8863-1)	Nessus	Ubuntu Local Security Checks	Local	medium
338187	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-102691)	Nessus	Unity Linux Local Security Checks	Local	low
330400	Linux Distros Unpatched Vulnerability : CVE-2026-17072	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-17072

low

Tenable Plugins

medium

medium

medium

high

low

low

medium

low

low