Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-1940: An out-of-bounds read in the WAV parser that can cause crashes for certain input files.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gstreamer-plugins-good | 0:0.10.31-20.amzn2.0.3 |
| Amazon Linux · 2 | gstreamer-plugins-good-debuginfo | 0:0.10.31-20.amzn2.0.3 |
| Amazon Linux · 2 | gstreamer-plugins-good-devel-docs | 0:0.10.31-20.amzn2.0.3 |
Vulnerabilities 1
-
Medium 5.1
Gstreamer: incomplete fix of cve-2026-1940
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. Whe…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-1940.html