Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-12T00:00:00 gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CWE-190

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

This flaw affects gstreamer1-plugins-good as shipped in Red Hat Enterprise Linux. The integer overflow in the buffer size calculation affects 64-bit systems the same way it does 32-bit platforms, as the multiplication is performed in 32-bit integer arithmetic before promotion to size_t for g_malloc(). WavPack is an uncommon audio format not typically used for streaming, so exploitation generally requires user interaction to open a malicious file. The fix is expected in upstream GStreamer 1.28.4. Red Hat would like to thank Seung Min Shin for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 2026-07-08T00:00:00Z RHSA-2026:36675 gstreamer1-plugins-good-0:1.26.7-2.el10_2.1 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-07-28T00:00:00Z RHSA-2026:47032 gstreamer1-plugins-good-0:1.24.11-1.el10_0.3 Red Hat Enterprise Linux 8 2026-07-08T00:00:00Z RHSA-2026:36774 gstreamer1-plugins-good-0:1.16.1-7.el8_10 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-28T00:00:00Z RHSA-2026:47174 gstreamer1-plugins-good-0:1.16.1-5.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-28T00:00:00Z RHSA-2026:47174 gstreamer1-plugins-good-0:1.16.1-5.el8_8.1 Red Hat Enterprise Linux 9 2026-07-09T00:00:00Z RHSA-2026:37129 gstreamer1-plugins-good-0:1.22.12-7.el9_8.1 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-07-28T00:00:00Z RHSA-2026:47052 gstreamer1-plugins-good-0:1.18.4-8.el9_2.1 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-07-28T00:00:00Z RHSA-2026:47050 gstreamer1-plugins-good-0:1.22.1-4.el9_4.1 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-07-28T00:00:00Z RHSA-2026:47051 gstreamer1-plugins-good-0:1.22.12-5.el9_6.1 Red Hat Enterprise Linux 7 Affected gstreamer1-plugins-good https://www.cve.org/CVERecord?id=CVE-2026-53705 https://nvd.nist.gov/vuln/detail/CVE-2026-53705