CVE-2026-17072

Summary

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-125: Out-of-bounds Read

Workarounds

The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered:

  1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build.
  2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin.

Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References