Description
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-bad1.0 | 1.28.6-1 | — |
| Debian 13 | gst-plugins-bad1.0 | 1.26.2-3+deb13u3 | — |
| Debian 12 | gst-plugins-bad1.0 | 1.22.0-4+deb12u8 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gst-plugins-bad1.0 | 1.28.2-1ubuntu1.2 | USN-8855-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gst-plugins-bad1.0 | 1.24.2-1ubuntu4+esm2 | USN-8855-1 |
| Ubuntu Pro 22.04 LTS | gst-plugins-bad1.0 | 1.20.3-0ubuntu1.1+esm3 | USN-8855-1 |
| Ubuntu Pro 20.04 LTS | gst-plugins-bad1.0 | 1.16.3-0ubuntu1.1+esm2 | USN-8855-1 |
| Ubuntu Pro 18.04 LTS | gst-plugins-bad1.0 | 1.14.5-0ubuntu1~18.04.1+esm2 | USN-8855-1 |
| Ubuntu Pro 16.04 LTS | gst-plugins-bad1.0 | 1.8.3-1ubuntu0.2+esm2 | USN-8855-1 |
| Ubuntu Pro 14.04 LTS | gst-plugins-bad1.0 | 1.2.4-1~ubuntu1.1+esm1 | USN-8855-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-bad-free +2 | 1.26.7-2.el10_2.7 | RHSA-2026:55433 |
| RHEL 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-7.el9_8.4 | RHSA-2026:55865 |
| RHEL 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.2 | RHSA-2026:55865 |
| RHEL 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-9.el8_10.2 | RHSA-2026:56521 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gstreamer1-plugins-bad-free +2 | 1.24.11-3.el10_0.7 | RHSA-2026:65123 |
| RHEL 9.6 EUS | gstreamer1-plugins-bad-free +2 | 1.22.12-5.el9_6.7 | RHSA-2026:65124 |
| RHEL 9.4 E4S | gstreamer1-plugins-bad-free | 1.22.1-6.el9_4.7 | RHSA-2026:66407 |
| RHEL 9.2 E4S | gstreamer1-plugins-bad-free | 1.18.4-9.el9_2.6 | RHSA-2026:65122 |
| RHEL 8.8 TUS | gstreamer1-plugins-bad-free | 1.16.1-4.el8_8.5 | RHSA-2026:67151 |
| RHEL 8.8 E4S | gstreamer1-plugins-bad-free | 1.16.1-4.el8_8.5 | RHSA-2026:67151 |
| RHEL 8.6 EUS Long Life | gstreamer1-plugins-bad-free | 1.16.1-4.el8_6.5 | RHSA-2026:66406 |
| RHEL 8.6 AUS | gstreamer1-plugins-bad-free | 1.16.1-4.el8_6.5 | RHSA-2026:66406 |
| RHEL 8.4 EUS Long Life | gstreamer1-plugins-bad-free | 1.16.1-4.el8_4.5 | RHSA-2026:67844 |
| RHEL 8.4 AUS | gstreamer1-plugins-bad-free | 1.16.1-4.el8_4.5 | RHSA-2026:67844 |
| RHEL 7 ELS | gstreamer1-plugins-bad-free +2 | 1.10.4-8.el7_9 | RHSA-2026:67861 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gstreamer1-plugins-bad-free +2 | 1.26.7-2.el10_2.7 | ALSA-2026:55433 |
| AlmaLinux 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-7.el9_8.4 | ALSA-2026:55865 |
| AlmaLinux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.2 | ALSA-2026:55865 |
| AlmaLinux 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-9.el8_10.2 | ALSA-2026:56521 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-bad-free | 1.26.7-2.el10_2.7 | RLSA-2026:55433 |
| Rocky Linux 9 | gstreamer1-plugins-bad-free | 1.22.12-7.el9_8.4 | RLSA-2026:55865 |
| Rocky Linux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.2 | RLSA-2026:55865 |
| Rocky Linux 8 | gstreamer1-plugins-bad-free | 1.16.1-9.el8_10.2 | RLSA-2026:56521 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gstreamer1-plugin-openh264 +3 | 1.24.10-1.amzn2023.0.9 | ALAS2023-2026-2119 |
| Amazon Linux 2 | gstreamer-plugins-bad-free +2 | 0.10.23-42.amzn2.0.6 | ALAS2-2026-3896 |
| Amazon Linux 2 | gstreamer1-plugins-bad-free +1 | 1.18.4-5.amzn2.0.9 | ALAS2-2026-3895 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gstreamer1-plugins-bad-free +2 | 1.26.7-2.el10_2.7 | ELSA-2026-55433 |
| Oracle Linux 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-7.el9_8.4 | ELSA-2026-55865 |
| Oracle Linux 9 | gstreamer1-plugins-ugly-free | 1.22.12-6.el9_8.2 | ELSA-2026-55865 |
| Oracle Linux 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-9.0.1.el8_10.2 | ELSA-2026-56521 |
| Oracle Linux 7 | gstreamer1-plugins-bad-free +2 | 1.10.4-4.0.7.el7_9 | ELSA-2026-67861 |
Advisories 26
- WID-SEC-2026-2662 GStreamer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026
- ALSA-2026:55865 Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55433 Important: gstreamer1-plugins-bad-free security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:56521 Important: gstreamer1-plugins-bad-free security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-67861 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 14, 2026
- USN-8855-1 gst-plugins-bad1.0 vulnerability Ubuntu Security Notices (USN) · Oct 1, 2026
- RHSA-2026:67861 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 19, 2026
- RHSA-2026:67844 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:67151 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:66406 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:66407 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:65124 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:65122 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:65123 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:56521 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:55865 Red Hat Security Advisory: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2026:55433 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- ALAS2-2026-3895 Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- ALAS2-2026-3896 Important: gstreamer-plugins-bad-free security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- ALAS2023-2026-2119 Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- RLSA-2026:56521 Important: gstreamer1-plugins-bad-free security update Rocky Linux Security Advisories · Aug 19, 2026
- ELSA-2026-56521 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 19, 2026
- RLSA-2026:55865 Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update Rocky Linux Security Advisories · Aug 18, 2026
- RLSA-2026:55433 Important: gstreamer1-plugins-bad-free security update Rocky Linux Security Advisories · Aug 17, 2026
- ELSA-2026-55865 Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- ELSA-2026-55433 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
References
- RHSA-2026:55433 vendor-advisory
- RHSA-2026:55865 vendor-advisory
- RHSA-2026:56521 vendor-advisory
- RHSA-2026:65122 vendor-advisory
- RHSA-2026:65123 vendor-advisory
- RHSA-2026:65124 vendor-advisory
- RHSA-2026:66406 vendor-advisory
- RHSA-2026:66407 vendor-advisory
- RHSA-2026:67151 vendor-advisory
- RHSA-2026:67844 vendor-advisory
- RHSA-2026:67861 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-19387 vdb-entry
- RHBZ#2513015 issue-tracking
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235
- https://gstreamer.freedesktop.org/releases/1.28/