Bug 2506750 (CVE-2026-17072)

Summary: CVE-2026-17072 gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-24 14:13:36 UTC 
A 4-byte heap-buffer-overflow (out-of-bounds read) was found in gst-plugins-good's Matroska demuxer, in the function gst_matroska_parse_flac_stream_headers() in gst/matroska/matroska-ids.c. When parsing FLAC codec private data embedded in a Matroska (MKV/WebM) container, the function iterates over FLAC metadata blocks. Each block has a 4-byte header (1 byte flags + 3 bytes length) followed by a body of 'len' bytes. The bounds check at line 309 validates 'off + len > codec_data_size' but the subsequent gst_buffer_new_memdup() at line 314 copies 'len + 4' bytes (body + header). When off + len == codec_data_size, the guard passes but the memdup reads 4 bytes past the end of the heap-allocated codec_data buffer. The correct check should be 'off + 4 + len > codec_data_size'. This function is called from matroska-demux.c line 7397 when processing A_FLAC audio tracks.

Affected versions: <= 1.28.5
Fixed in version: 1.28.6 (upcoming)
Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/111 (GST-SA-2026-0073)
Reporter: Yazan Balawneh, CyStack Security Team
ASan confirmation on GStreamer 1.28.4, Kali Linux x86_64: heap-buffer-overflow READ of size 42, 0 bytes after 42-byte region.
PSIRT Ticket: PSIRTSUPT-19737