CoreCVE
Back

HIGH

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

Published Jun 15, 2026

Description

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

This flaw affects gstreamer1-plugins-good as shipped in Red Hat Enterprise Linux. The integer overflow in the buffer size calculation affects 64-bit systems the same way it does 32-bit platforms, as the multiplication is performed in 32-bit integer arithmetic before promotion to size_t for g_malloc(). WavPack is an uncommon audio format not typically used for streaming, so exploitation generally requires user interaction to open a malicious file. The fix is expected in upstream GStreamer 1.28.4.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-190

Integer Overflow

References (16)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jun 15, 2026
Updated Aug 3, 2026
Reserved Jun 10, 2026
Link CVE-2026-53705
CISA Vulnrichment
Updated Jun 16, 2026
NVD
Status Awaiting Analysis
Modified Aug 3, 2026
Link CVE-2026-53705
Red Hat
Severity Important
Public date Jun 12, 2026
Links CVE-2026-53705 - Bugzilla