Low [CVE-2026-17072] 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers
This low-severity Red Hat Linux advisory covers CVE-2026-17072 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file.
The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as a victim must open a crafted Matroska or WebM media file.
In practice, modern heap allocators align allocations such that the 4 overread bytes typically fall within adjacent allocated memory, making a crash unlikely in production builds. Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS 2 ship gstreamer1-plugins-good with the affected Matroska demuxer code path and are affected.
All RHEL and RHIVOS streams are deferred (low severity, low exploitability). Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Weakness: CWE-125.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered: 1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build. 2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin. Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.