CVE-2026-17072

Name	CVE-2026-17072
Description	A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gst-plugins-good1.0 (PTS)	bullseye	1.18.4-2+deb11u2	vulnerable
	bullseye (security)	1.18.4-2+deb11u4	vulnerable
	bookworm	1.22.0-5+deb12u3	vulnerable
	bookworm (security)	1.22.0-5+deb12u2	vulnerable
	trixie (security), trixie	1.26.2-1+deb13u2	vulnerable
	forky, sid	1.28.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gst-plugins-good1.0	source	(unstable)	(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2506750
check ater information published on upstream, should become https://gstreamer.freedesktop.org/security/sa-2026-0073.html