Summary
It was discovered that GStreamer Bad Plugins incorrectly validated the size
of multi-channel audio blocks. An attacker could possibly use this issue
with a specially crafted WAV file to cause the program to crash, resulting
in a denial of service, or possibly execute arbitrary code.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | gst-plugins-bad1.0 | 1.28.2-1ubuntu1.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | gst-plugins-bad1.0 | 1.2.4-1~ubuntu1.1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gst-plugins-bad1.0 | 1.8.3-1ubuntu0.2+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gst-plugins-bad1.0 | 1.14.5-0ubuntu1~18.04.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gst-plugins-bad1.0 | 1.16.3-0ubuntu1.1+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | gst-plugins-bad1.0 | 1.20.3-0ubuntu1.1+esm3 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | gst-plugins-bad1.0 | 1.24.2-1ubuntu4+esm2 |
Vulnerabilities 1
-
High 7.6
Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes b…
References
-
report
https://ubuntu.com/security/CVE-2026-19387