REDHAT-BUG-2506750: Low severity GStreamer gst-plugins-good vulnerability
A 4-byte heap-buffer-overflow (out-of-bounds read) was found in gst-plugins-good's Matroska demuxer, in the function gstmatroskaparseflacstreamheaders() in gst/matroska/matroska-ids.c. When parsing FLAC codec private data embedded in a Matroska (MKV/WebM) container, the function iterates over FLAC metadata blocks. Each block has a 4-byte header (1 byte flags + 3 bytes length) followed by a body of 'len' bytes. The bounds check at line 309 validates 'off + len > codecdatasize' but the subsequent gstbuffernewmemdup() at line 314 copies 'len + 4' bytes (body + header). When off + len == codecdatasize, the guard passes but the memdup reads 4 bytes past the end of the heap-allocated codecdata buffer. The correct check should be 'off + 4 + len > codecdatasize'. This function is called from matroska-demux.c line 7397 when processing AFLAC audio tracks.
Affected versions: <= 1.28.5 Fixed in version: 1.28.6 (upcoming) Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/111 (GST-SA-2026-0073) Reporter: Yazan Balawneh, CyStack Security Team ASan confirmation on GStreamer 1.28.4, Kali Linux x8664: heap-buffer-overflow READ of size 42, 0 bytes after 42-byte region. PSIRT Ticket: PSIRTSUPT-19737
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gstreamer/gst-plugins-good (Matroska demuxer; gst_matroska_parse_flac_stream_headers in gst/matroska/matroska-ids.c)to a version that resolves this vulnerability.Fixed in 1.28.6Patch GST-SA-2026-0073 - Configuration
Correct the FLAC codec private-data block bounds check to validate 'off + 4 + len > codec_data_size' (instead of only 'off + len > codec_data_size') because gst_buffer_new_memdup() copies 'len + 4' bytes (block header + body).
Matroska demuxer (gst_matroska_parse_flac_stream_headers) bounds check = off + 4 + len > codec_data_size - Compensating control
Use a firewall/WAF/network isolation control to restrict access to systems running the Matroska (MKV/WebM) parser for untrusted input until the GStreamer 1.28.6 upgrade is applied.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2506750?
The severity of REDHAT-BUG-2506750 is low.
How do I fix REDHAT-BUG-2506750?
To fix REDHAT-BUG-2506750, update to the latest version of GStreamer gst-plugins-good that addresses this vulnerability.
What does REDHAT-BUG-2506750 affect?
REDHAT-BUG-2506750 affects the GStreamer gst-plugins-good's Matroska demuxer.
What type of vulnerability is REDHAT-BUG-2506750?
REDHAT-BUG-2506750 is a 4-byte heap-buffer-overflow (out-of-bounds read) vulnerability.
When was REDHAT-BUG-2506750 reported?
REDHAT-BUG-2506750 was published on July 24, 2026.