Detections
Analytics
TencentOS Server 4: gstreamer1-plugins-good (TSSA-2026:0948)
medium Nessus Plugin ID 342178
Synopsis
The remote TencentOS Server 4 host is missing one or more security updates.Description
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0948 advisory.Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:
CVE-2026-73434:
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).
CVE-2026-73433:
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets without verifying sufficient data remains, causing heap out-of-bounds read/write and denial of service.
CVE-2025-47183:
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.
Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 342178
File Name: tencentos_TSSA_2026_0948.nasl
Version: 1.1
Type: Local
Family: Tencent Local Security Checks
Published: 9/1/2026
Updated: 9/1/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C
CVSS Score Source: CVE-2026-73434
CVSS v3
Risk Factor: Medium
Base Score: 6.6
Temporal Score: 5.9
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2026-73433
Vulnerability Information
CPE: cpe:/o:tencent:tencentos_server:4, p-cpe:/a:tencent:tencentos_server:gstreamer1-plugins-good
Required KB Items: Host/local_checks_enabled, Host/etc/os-release, Host/TencentOS/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/1/2026
Vulnerability Publication Date: 8/7/2025