---
id: CVE-2026-17072
title: >-
  Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in
  gst_matroska_parse_flac_stream_headers when parsing flac codec data in
  matroska containers
summary: >-
  A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds
  read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a
  Matroska or WebM container file. The vulnerability is triggered by a boundary
  che…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: gstreamer1-plugins-good
affected:
  - gstreamer1-plugins-good (all versions)
  - gstreamer-plugins-good (all versions)
  - gstreamer1-plugins-good (all versions)
  - gstreamer-plugins-good (all versions)
  - gstreamer1-plugins-good (all versions)
  - gstreamer1-plugins-good (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-28T14:01:26.432270Z'
published: '2026-07-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:08:37.391Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-17072'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-17072'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506750'
    label: RHBZ#2506750
  - url: >-
      https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/111
tags:
  - cve.org
epss: 0.00116
epssPercentile: 0.01639
ingestedAt: '2026-11-06T19:01:36.641Z'
---

## Overview

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

## Affected

- `gstreamer1-plugins-good (all versions)`
- `gstreamer-plugins-good (all versions)`
- `gstreamer1-plugins-good (all versions)`
- `gstreamer-plugins-good (all versions)`
- `gstreamer1-plugins-good (all versions)`
- `gstreamer1-plugins-good (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

The matroska demuxer plugin can be disabled to prevent this vulnerability from being triggered:

1. Build time: Pass '-Dgst-plugins-good:matroska=disabled' to the meson build system to exclude the entire matroska plugin from the build.
2. Runtime: Remove the libgstmatroska shared library from the GStreamer plugin directory, or use the GST_PLUGIN_PATH environment variable to point to a plugin directory that excludes the matroska plugin.

Note: Disabling the matroska plugin will prevent playback of all MKV and WebM files.