Vulnerability · Published Jun 15, 2026 · Assigned by redhat
CVE-2026-53705Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow
High 7.6
In plain English
A high-severity integer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | gstreamer1-plugins-good | 1.26.7-2.el10_2.1 | ALSA-2026:36675 |
| AlmaLinux:8 | gstreamer1-plugins-good | 1.16.1-7.el8_10 | ALSA-2026:36774 |
| AlmaLinux:9 | gstreamer1-plugins-good | 1.22.12-7.el9_8.1 | ALSA-2026:37129 |
| AlmaLinux:10 | gstreamer1-plugins-good-gtk | 1.26.7-2.el10_2.1 | ALSA-2026:36675 |
| AlmaLinux:8 | gstreamer1-plugins-good-gtk | 1.16.1-7.el8_10 | ALSA-2026:36774 |
| AlmaLinux:9 | gstreamer1-plugins-good-gtk | 1.22.12-7.el9_8.1 | ALSA-2026:37129 |
| Debian:12 | gst-plugins-good1.0 | 1.22.0-5+deb12u4 | DEBIAN-CVE-2026-53705 |
| Debian:13 | gst-plugins-good1.0 | no fix listed | DEBIAN-CVE-2026-53705 |
| Debian:14 | gst-plugins-good1.0 | 1.28.4-1 | DEBIAN-CVE-2026-53705 |
| Rocky Linux:10 | gstreamer1-plugins-good | 0:1.26.7-2.el10_2.1 | RLSA-2026:36675 |
| Rocky Linux:8 | gstreamer1-plugins-good | 0:1.16.1-7.el8_10 | RLSA-2026:36774 |
| Rocky Linux:9 | gstreamer1-plugins-good | 0:1.22.12-7.el9_8.1 | RLSA-2026:37129 |
| Ubuntu:22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.7 | UBUNTU-CVE-2026-53705 |
| Ubuntu:22.04:LTS | gst-plugins-good1.0 | 1.20.3-0ubuntu1.7 | USN-8584-1 |
| Ubuntu:24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.5 | USN-8584-1 |
| Ubuntu:24.04:LTS | gst-plugins-good1.0 | 1.24.2-1ubuntu1.5 | UBUNTU-CVE-2026-53705 |
| Ubuntu:25.10 | gst-plugins-good1.0 | no fix listed | UBUNTU-CVE-2026-53705 |
| Ubuntu:26.04:LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.1 | USN-8584-1 |
| Ubuntu:26.04:LTS | gst-plugins-good1.0 | 1.28.2-2ubuntu0.1 | UBUNTU-CVE-2026-53705 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References
- RHSA-2026:36675 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:36774 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:37129 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:47032 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:47050 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:47051 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:47052 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:47174 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:49602 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:49603 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:49604 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-53705 vdb-entry, x_refsource_REDHAT
- RHBZ#2487615 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json x_sadp-csaf-vex