Описание
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
Отчет
This flaw affects gstreamer1-plugins-good as shipped in Red Hat Enterprise Linux. The integer overflow in the buffer size calculation affects 64-bit systems the same way it does 32-bit platforms, as the multiplication is performed in 32-bit integer arithmetic before promotion to size_t for g_malloc(). WavPack is an uncommon audio format not typically used for streaming, so exploitation generally requires user interaction to open a malicious file. The fix is expected in upstream GStreamer 1.28.4.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | gstreamer1-plugins-good | Affected | ||
| Red Hat Enterprise Linux 10 | gstreamer1-plugins-good | Fixed | RHSA-2026:36675 | 08.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | gstreamer1-plugins-good | Fixed | RHSA-2026:47032 | 28.07.2026 |
| Red Hat Enterprise Linux 8 | gstreamer1-plugins-good | Fixed | RHSA-2026:36774 | 08.07.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | gstreamer1-plugins-good | Fixed | RHSA-2026:47174 | 28.07.2026 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | gstreamer1-plugins-good | Fixed | RHSA-2026:47174 | 28.07.2026 |
| Red Hat Enterprise Linux 9 | gstreamer1-plugins-good | Fixed | RHSA-2026:37129 | 09.07.2026 |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | gstreamer1-plugins-good | Fixed | RHSA-2026:47052 | 28.07.2026 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | gstreamer1-plugins-good | Fixed | RHSA-2026:47050 | 28.07.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | gstreamer1-plugins-good | Fixed | RHSA-2026:47051 | 28.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.6 High
CVSS3
Связанные уязвимости
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-g ...
EPSS
7.6 High
CVSS3