CVE-2026-1940

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1940
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

5.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2026-1940 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2436932 Issue Tracking Vendor Advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 Broken Link
https://gstreamer.freedesktop.org/security/sa-2026-0001.html Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-1940 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:freedesktop:gst-plugins-good:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
History

04 May 2026, 15:30

Type Values Removed Values Added
Summary
  • (es) Una solución incompleta para CVE-2024-47778 permite una lectura fuera de límites en la función gst_wavparse_adtl_chunk(). El parche añadió una comprobación de validación de tamaño lsize + 8 > size, pero no tiene en cuenta el GST_ROUND_UP_2(lsize) utilizado en el cálculo real del desplazamiento. Cuando lsize es un número impar, el analizador avanza más bytes de los validados, provocando una lectura OOB.
References () https://access.redhat.com/security/cve/CVE-2026-1940 - () https://access.redhat.com/security/cve/CVE-2026-1940 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2436932 - () https://bugzilla.redhat.com/show_bug.cgi?id=2436932 - Issue Tracking, Vendor Advisory
References () https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 - () https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 - Broken Link
References () https://gstreamer.freedesktop.org/security/sa-2026-0001.html - () https://gstreamer.freedesktop.org/security/sa-2026-0001.html - Vendor Advisory
References () https://security-tracker.debian.org/tracker/CVE-2026-1940 - () https://security-tracker.debian.org/tracker/CVE-2026-1940 - Third Party Advisory
First Time Gstreamer gstreamer
Freedesktop gst-plugins-good
Debian debian Linux
Redhat
Redhat enterprise Linux
Freedesktop
Gstreamer
Debian
CPE cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:freedesktop:gst-plugins-good:1.0.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

24 Mar 2026, 14:16

Type Values Removed Values Added
CWE CWE-125

23 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 22:16

Updated : 2026-05-04 15:30

NVD link : CVE-2026-1940

Mitre link : CVE-2026-1940

CVE.ORG link : CVE-2026-1940

JSON object : View

Products Affected

freedesktop

  • gst-plugins-good

debian

  • debian_linux

gstreamer

  • gstreamer

redhat

  • enterprise_linux
CWE
CWE-125

Out-of-bounds Read