Skip to main content

gst-plugins-bad EUVDEUVD-2026-54986

| CVE-2026-19387 HIGH
Out-of-bounds Write (CWE-787)
2026-08-10 redhat GHSA-32fh-qx9x-qfwj
RCE Buffer Overflow Denial Of Service Memory Corruption Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.6
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
vuln.today AI
7.6 HIGH

File is network-deliverable but requires victim interaction; no auth needed; heap corruption yields high availability impact with limited confidentiality and integrity exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Red Hat
7.6 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 03:28 vuln.today
CVE Published
Aug 10, 2026 - 02:36 nvd
HIGH 7.6

DescriptionCVE.org

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

AnalysisAI

Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.

Technical ContextAI

GStreamer is a widely-used open-source pipeline-based multimedia framework common on Linux desktops and embedded systems. The gst-plugins-bad package provides supplementary GStreamer elements, including adpcmdec, which decodes IMA/DVI ADPCM (Adaptive Differential Pulse Code Modulation) audio - a lossy compression scheme historically used in WAV-container audio files. CWE-787 (Out-of-bounds Write) is the root cause class: the decoder does not sufficiently validate the per-block sample count field when processing multi-channel streams, permitting computed write offsets to exceed the allocated heap output buffer. Affected CPEs are cpe:2.3:a:red_hat:red_hat_enterprise_linux_7/8/9/10 as reported by Red Hat, indicating the vulnerability exists in the upstream GStreamer codebase and was identified through Red Hat's security pipeline.

RemediationAI

An upstream fix has been submitted as GitLab merge request #12235 against the GStreamer repository (gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235); a tagged released version incorporating this fix is not independently confirmed from available input data - the GStreamer 1.28 release page is referenced and may contain the patch. Red Hat Enterprise Linux users should monitor the RHEL advisory at access.redhat.com/security/cve/CVE-2026-19387 and apply updates via dnf once an errata is published. As a compensating control pending a patch, restrict or sandbox media processing applications that handle untrusted WAV files - specifically, prevent automated thumbnail generators, media indexers, or transcoding services from processing externally sourced audio without prior content inspection. Disabling IMA/DVI ADPCM decoding at the pipeline level via GStreamer feature flags, if operationally feasible, would eliminate the vulnerable code path entirely at the cost of losing ADPCM playback support.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

EUVD-2026-54986 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy