Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4023
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory. (CVE-2026-17072)
A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). (CVE-2026-73434)
Affected Packages:
gstreamer-plugins-good
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gstreamer-plugins-good or yum update --advisory ALAS2-2026-4023 to update your system.
aarch64:
gstreamer-plugins-good-0.10.31-20.amzn2.0.7.aarch64
gstreamer-plugins-good-debuginfo-0.10.31-20.amzn2.0.7.aarch64
i686:
gstreamer-plugins-good-0.10.31-20.amzn2.0.7.i686
gstreamer-plugins-good-debuginfo-0.10.31-20.amzn2.0.7.i686
noarch:
gstreamer-plugins-good-devel-docs-0.10.31-20.amzn2.0.7.noarch
src:
gstreamer-plugins-good-0.10.31-20.amzn2.0.7.src
x86_64:
gstreamer-plugins-good-0.10.31-20.amzn2.0.7.x86_64
gstreamer-plugins-good-debuginfo-0.10.31-20.amzn2.0.7.x86_64