Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Deliver crafted WAV via web/email/share
  2. Delivery
    Victim opens or previews malicious file
  3. Exploit
    GStreamer loads adpcmdec element
  4. Install
    Decoder parses multi-channel IMA/DVI ADPCM block
  5. C2
    Unchecked sample count causes heap write past buffer
  6. Execute
    Memory corruption or application crash
  7. Impact
    Potential arbitrary code execution

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to open or trigger playback of a crafted WAV file containing IMA/DVI ADPCM encoded audio in a multi-channel stream configuration (UI:R per CVSS). The vulnerable code path is reached only when the adpcmdec GStreamer element is loaded and processes IMA/DVI ADPCM multi-channel content - files using other codecs or mono ADPCM streams are not affected. The user interaction requirement limits automated mass exploitation in interactive desktop scenarios; however, server-side or backend systems that ingest and process untrusted media files programmatically (e.g., transcoding APIs, content upload pipelines, media asset management systems) may encounter this vulnerability without requiring a human to explicitly open a file, effectively removing the UI:R practical constraint in those deployments.
Impact

The CVSS 7.6 score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) is internally consistent: network-deliverable via web, email, or file share, low complexity, no privileges required, but requiring victim interaction (opening or playing the file). The UI:R constraint meaningfully reduces mass-exploitation risk in interactive desktop contexts. However, automated media ingestion pipelines - thumbnail generators, media indexers, transcoding services - that process untrusted files programmatically may not benefit from the UI:R constraint in practice, as no human gesture is involved. No EPSS data was provided in the input; exploitation probability cannot be quantified from available signals. The CVE is not listed in CISA KEV and no POC is identified, indicating no confirmed or widespread in-the-wild exploitation. The primary real-world risk is application crash or DoS when untrusted WAV files reach GStreamer-based applications; the RCE vector, while technically plausible for a heap OOB write, is non-trivial to reliably exploit and remains unconfirmed.
Exploit ScenarioDerived

An attacker hosts or emails a specially crafted WAV file embedding a multi-channel IMA/DVI ADPCM audio stream with an invalid per-block sample count. When a victim opens the file using a GStreamer-based application - a media player, GNOME file manager preview, or browser audio handler - the adpcmdec element writes past the allocated heap buffer. Depending on heap layout, this results in an application crash at minimum or, in a more carefully engineered attack, controlled memory corruption enabling code execution in the context of the victim application.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 10, 2026

Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.

RemediationAI

An upstream fix has been submitted as GitLab merge request #12235 against the GStreamer repository (gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235); a tagged released version incorporating this fix is not independently confirmed from available input data - the GStreamer 1.28 release page is referenced and may contain the patch. Red Hat Enterprise Linux users should monitor the RHEL advisory at access.redhat.com/security/cve/CVE-2026-19387 and apply updates via dnf once an errata is published. As a compensating control pending a patch, restrict or sandbox media processing applications that handle untrusted WAV files - specifically, prevent automated thumbnail generators, media indexers, or transcoding services from processing externally sourced audio without prior content inspection. Disabling IMA/DVI ADPCM decoding at the pipeline level via GStreamer feature flags, if operationally feasible, would eliminate the vulnerable code path entirely at the cost of losing ADPCM playback support.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is a widely-used open-source pipeline-based multimedia framework common on Linux desktops and embedded systems. The gst-plugins-bad package provides supplementary GStreamer elements, including adpcmdec, which decodes IMA/DVI ADPCM (Adaptive Differential Pulse Code Modulation) audio - a lossy compression scheme historically used in WAV-container audio files. CWE-787 (Out-of-bounds Write) is the root cause class: the decoder does not sufficiently validate the per-block sample count field when processing multi-channel streams, permitting computed write offsets to exceed the allocated heap output buffer. Affected CPEs are cpe:2.3:a:red_hat:red_hat_enterprise_linux_7/8/9/10 as reported by Red Hat, indicating the vulnerability exists in the upstream GStreamer codebase and was identified through Red Hat's security pipeline.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
vuln.today AI 7.6 HIGH

File is network-deliverable but requires victim interaction; no auth needed; heap corruption yields high availability impact with limited confidentiality and integrity exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Red Hat 7.6 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

DescriptionCVE.org

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

Executive ViewAI

Why It Matters

GStreamer's audio decoder component in Red Hat Enterprise Linux 7-10 contains a memory corruption vulnerability (CVE-2026-19387, CVSS 7.6) triggered by malformed WAV files, potentially causing application crashes or code execution when systems process untrusted media. Organizations running affected RHEL versions face operational disruption and potential compromise risk, requiring immediate inventory and mitigation planning.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: disable GStreamer adpcmdec plugin if unused; implement application-level audio file validation before processing; restrict or sandbox media processing from untrusted sources; apply network segmentation to control access to media delivery points; enable logging on media processing applications to detect exploitation attempts.

Threat Intelligence Overview

EPSS Score
0.2%
Top 85% exploitable
Prevalence
High
Core multimedia framework across Linux desktop and server ecosystems
Social Media
4
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

Related Vulnerabilities in GStreamer gst-plugins Parsing Vulnerabilities

View all 2
CVE-2026-19389 HIGH
7.1

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-19387 ADVISORY https://vuldb.com/vuln/387289 REF https://access.redhat.com/errata/RHSA-2026:55433 REF https://access.redhat.com/errata/RHSA-2026:55865 REF https://access.redhat.com/errata/RHSA-2026:56521 REF https://access.redhat.com/errata/RHSA-2026:65122 REF https://access.redhat.com/errata/RHSA-2026:65123 REF https://access.redhat.com/errata/RHSA-2026:65124 REF https://access.redhat.com/errata/RHSA-2026:66406 REF https://access.redhat.com/errata/RHSA-2026:66407 REF https://access.redhat.com/errata/RHSA-2026:67151 REF https://access.redhat.com/errata/RHSA-2026:67844 REF https://access.redhat.com/errata/RHSA-2026:67861 REF https://access.redhat.com/security/cve/CVE-2026-19387 REF https://bugzilla.redhat.com/show_bug.cgi?id=2513015 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235 REF https://gstreamer.freedesktop.org/releases/1.28/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy