UBUNTU-CVE-2026-73473: Ubuntu/gst-plugins-good1.0 vulnerability

Published Nov 6, 2026

Updated

A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).

Affected Software

6 affected components

ubuntu/gst-plugins-good1.0*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-good (avidemux) to a version that resolves this vulnerability.
Fixed in 1.28.6Patch GStreamer-SA-2026-0072

Event History

Nov 6, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems and workflows are exposed to this issue?

Systems using Ubuntu's gst-plugins-good1.0 package are exposed when GStreamer processes AVI content through playbin, decodebin, or gst-discoverer. These components auto-plug avidemux, so media playback, previewing, inspection, or metadata-discovery workflows that open an attacker-crafted AVI can trigger the flaw.

What does an attacker need to do to exploit it?

An attacker needs to provide a crafted AVI file and have it opened or previewed by a vulnerable GStreamer workflow. No separate manual selection of the avidemux component is required because it is auto-plugged by the affected GStreamer components.

What can be done while waiting for a package update?

Avoid opening, previewing, or automatically inspecting untrusted AVI files in affected GStreamer-based workflows. In particular, limit use of applications or services that invoke playbin, decodebin, or gst-discoverer on externally supplied media.

How can I determine whether the issue has been remediated upstream?

The issue is fixed upstream in gst-plugins-good version 1.28.6. The provided data does not identify the corresponding Ubuntu package version, so verify the Ubuntu security update status for the installed gst-plugins-good1.0 package.

UBUNTU-CVE-2026-73473: Ubuntu/gst-plugins-good1.0 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems and workflows are exposed to this issue?

What does an attacker need to do to exploit it?

What can be done while waiting for a package update?

How can I determine whether the issue has been remediated upstream?

Company

Resources

Contact

Frequently Asked Questions

Which systems and workflows are exposed to this issue?

What does an attacker need to do to exploit it?

What can be done while waiting for a package update?

How can I determine whether the issue has been remediated upstream?