CVE-2026-53705Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 10 and 7 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
- CVSS
- 7.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
- Weakness (CWE)
- CWE-190
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:1.26.7-2.el10_2.1 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:1.24.11-1.el10_0.3 not affected | CNA record |
from 0:1.10.4-4.el7_9.1 not affected | CNA record | |
from 0:1.16.1-4.el8_4.1 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support redhat:rhel_eus_long_life | from 0:1.16.1-4.el8_4.1 not affected | CNA record |
from 0:1.16.1-5.el8_8.1 not affected | CNA record | |
from 0:1.16.1-5.el8_8.1 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:1.22.12-5.el9_6.1 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:1.26.7-2.el10_2.1 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:1.24.11-1.el10_0.3 not affected | CISA ADP |
from 0:1.16.1-5.el8_8.1 not affected | CISA ADP | |
from 0:1.16.1-5.el8_8.1 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:1.22.12-5.el9_6.1 not affected | CISA ADP |
References
- https://access.redhat.com/errata/RHSA-2026:36675vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:36774vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:37129vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47032vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47050vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47051vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47052vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47174vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:49602vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:49603vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:49604vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2026-53705vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2487615issue-tracking, x-refsource-redhat
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.