CVE-2026-17072

Low [CVE-2026-17072] 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers

CVE-2026-17072Source published Jul 28, 2026Source updated Jul 28, 2026

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory. This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8

3 more entries in the full advisory.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered: 1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build. 2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin. Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.