CVE-2026-17072 | BDVDB-2026-353221 Detail

Description#

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-28Record published in the CVE List.
2. Version 22026-11-06Most recent update recorded in the CVE List.