CVE-2026-17072: Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers

Vulnerability summary

CVE-2026-17072 is a low (CVSS 3.3) Out-of-bounds Read vulnerability in gst-plugins-good1.0. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.

Timeline

1. 28-07-2026
   PublishedVulnerability first disclosed.
2. 28-07-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.