Executive brief
GStreamer is a widely used multimedia framework for handling audio and video playback on Linux and other systems. A flaw in how it processes FLAC audio files could allow a malicious file to read a small amount of memory it shouldn't have access to. While the risk of significant data theft is low, an attacker could potentially gain insight into the system's memory by tricking a user into opening a specially crafted media file.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Matroska demuxer within gst-plugins-good, specifically in the gst_matroska_parse_flac_stream_headers() function in gst/matroska/matroska-ids.c. The root cause is an insufficient boundary check that validates the offset and length of FLAC metadata blocks but fails to account for the 4-byte header when performing a memory duplication (gst_buffer_new_memdup). When the block length matches the remaining buffer size, the function reads 4 bytes past the allocated buffer. This can be triggered by a local user opening a specially crafted Matroska (.mkv) or WebM file. The issue is fixed in GStreamer version 1.28.6.
Affected products
- GStreamer gst-plugins-good <= 1.28.5
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-24: disclosed: Reported by Yazan Balawneh of CyStack Security Team
- 2026-07-28: advisory: NVD and Red Hat published advisory details