CVE-2026-73434

CVE-2026-73434 in GStreamer's avi demuxer presents as a straightforward integer division flaw in gst_avi_demux_riff_parse_vprp(), but its implications extend well beyond the immediate function. The vulnerability computes loop bounds by dividing remaining buffer size by an attacker-controlled value from the AVI header—a classic pattern that has surfaced across ffmpeg, VLC, and libav in similar form. The CVSS 6.1 score dramatically understates the real blast radius: the corrupted field descriptors propagate downstream to playbin and decodebin, poisoning compositor initialization and colorimetry setup. A demuxer misreporting field count doesn't just crash—it corrupts the pipeline state that renderers depend on. The immediate action is to patch gst_avi_demux_riff_parse_vprp() with a safe iteration helper that constrains loop counts to the lesser of the declared entry count and the remaining buffer capacity divided by the entry size. However, this single fix is temporary relief. The deeper problem is that GStreamer's plugin API hands buffer pointers to authors without bounds-constrained iteration primitives, and the riff parsing cluster (strf, strl, movi, idx1 handlers) shares the same flawed arithmetic patterns laterally—new plugins inherit the pathology as 'idiomatic' code. Check your deployment for other riff sub-parsers using the same divide-by-header-field pattern, not just in avi handling but in any plugin that emerged from the same 'mature code' era. The 3-4 year gap between this and CVE-2021-33291 (same structural flaw in GStreamer riff parsing) shows that instance-level patching doesn't retire the class debt. Prioritize a defensive iteration wrapper for any format handler that derives loop bounds from file metadata, and add fuzzing harness coverage for division operations on file-derived divisors.

Reviewed through automated stages and approved by a human before publication.