CVE-2026-17072: Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers
A 4-byte heap-buffer-overflow (out-of-bounds read) was found in gst-plugins-good's Matroska demuxer, in the function gstmatroskaparseflacstreamheaders() in gst/matroska/matroska-ids.c. When parsing FLAC codec private data embedded in a Matroska (MKV/WebM) container, the function iterates over FLAC metadata blocks. Each block has a 4-byte header (1 byte flags + 3 bytes length) followed by a body of 'len' bytes. The bounds check at line 309 validates 'off + len > codecdatasize' but the subsequent gstbuffernewmemdup() at line 314 copies 'len + 4' bytes (body + header). When off + len == codecdatasize, the guard passes but the memdup reads 4 bytes past the end of the heap-allocated codecdata buffer. The correct check should be 'off + 4 + len > codecdatasize'. This function is called from matroska-demux.c line 7397 when processing AFLAC audio tracks.
Affected versions: <= 1.28.5 Fixed in version: 1.28.6 (upcoming) Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/111 (GST-SA-2026-0073) Reporter: Yazan Balawneh, CyStack Security Team ASan confirmation on GStreamer 1.28.4, Kali Linux x8664: heap-buffer-overflow READ of size 42, 0 bytes after 42-byte region. PSIRT Ticket: PSIRTSUPT-19737
Other sources
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-good (GStreamer) gst_matroska_parse_flac_stream_headersto a version that resolves this vulnerability.Fixed in 1.28.6Patch GST-SA-2026-0073 - Compensating control
Until the fixed release is deployed, avoid opening untrusted Matroska/WebM files with FLAC audio tracks (matroska-demux processing of A_FLAC) to reduce exposure to the heap out-of-bounds read.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17072?
The severity of CVE-2026-17072 is classified as low with a score of 3.3.
How can I mitigate CVE-2026-17072?
To mitigate CVE-2026-17072, you should update to the latest version of GStreamer gst-plugins-good that addresses the vulnerability.
What type of vulnerability is CVE-2026-17072?
CVE-2026-17072 is a heap-buffer-overflow vulnerability due to an out-of-bounds read in the Matroska demuxer of GStreamer.
Is CVE-2026-17072 a remote exploit?
CVE-2026-17072 is considered a low-risk vulnerability primarily affecting local usage scenarios.
What software is affected by CVE-2026-17072?
CVE-2026-17072 affects the GStreamer gst-plugins-good, specifically its Matroska demuxer.