USN-8863-1: GStreamer Good Plugins vulnerabilities
Ubuntu patched GStreamer Good Plugins flaws that could leak data or crash via crafted media.
Canonical issued USN-8863-1 for vulnerabilities in GStreamer Good Plugins. CVE-2026-17072, reported by Yazan Balawneh, comes from incorrect handling of certain FLAC streams and could expose sensitive information. Seonwook Kim reported CVE-2026-73433 and CVE-2026-73434 in AVI parsing; the first may cause denial of service or information disclosure, and the second denial of service. The excerpt also starts describing a closed-caption parsing issue but does not include its identifier.
- CVE-2026-17072: crafted FLAC streams may disclose sensitive information.
- CVE-2026-73433: malformed AVI files may crash playback or leak data.
- CVE-2026-73434: a separate AVI parsing bug can cause denial of service.
- The notice does not report exploitation in the wild.
- Vendors
- GStreamer
- Products
- GStreamer Good PluginsUbuntu
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-17072 | GStreamer's gst-plugins-good: A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM… | 3.3 | <1% | ||
CVE-2026-73433+1 related CVE | GStreamer gst-plugins-good (avidemux): When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed… | 6.6 group max | <1% |
From the original article
Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-17072) Seonwook Kim discovered that GStreamer Good Plugins incorrectly parsed certain AVI files.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.