CVE-2026-1940
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk(). The added check lsize + 8 > size does not account for GST_ROUND_UP_2(lsize) used in offset calculation, so odd lsize values cause the parser to advance beyond validated bounds.
Risk Assessment
Can lead to out-of-bounds memory read when processing WAV files, potentially causing application crashes or data leakage.
Recommendation
Update GStreamer (gst-plugins-good WAV parser) to a version containing the complete fix; avoid processing untrusted WAV files until updated.
Other vulnerabilities in GStreamer
See all- CVE-2017-5843High
Multiple use-after-free vulnerabilities in the gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags.
- CVE-2017-5840High
The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.
- CVE-2017-5838High
The gst_date_time_new_from_iso8601_string function in GStreamer before version 1.10.3 allows remote attackers to cause a denial of service via a malformed datetime string, leading to an out-of-bounds heap read.
- CVE-2016-9447High
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
- CVE-2016-9446High
The vmnc decoder in gstreamer does not initialize the render canvas, allowing remote attackers to obtain sensitive information. This is demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
- CVE-2016-9445High
Integer overflow in the vmnc decoder in gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
- CVE-2016-9809High
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before version 1.10.2 allows remote attackers to have unspecified impact via a crafted file, leading to an out-of-bounds read.
- CVE-2016-9808High
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
- CVE-2026-111183Critical
The rtpL16depay element in GStreamer has a heap-based buffer overflow due to missing validation of user-supplied data length before copying. This allows a remote attacker to execute arbitrary code in the context of the current process.
- CVE-2024-47606Critical
An integer underflow was detected in GStreamer's qtdemux_parse_theora_extension function in qtdemux.c. This leads to an allocation size overflow, overwriting the GstMapInfo structure and potentially hijacking a function pointer, which may allow arbitrary code execution.
Original NVD description (English source)
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS