CVE-2026-19387
CVE-2026-19387 · Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
CVSS 7.6 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:1.26.7-2.el10_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 10.0 extended update support
- Versions
- ≥ 0:1.24.11-3.el10_0.7: Not affected (rpm)
No fix published
red hat enterprise linux 7 extended lifecycle support
- Versions
- ≥ 0:1.10.4-8.el7_9: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 0:1.16.1-9.el8_10.2: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
- Versions
- ≥ 0:1.16.1-4.el8_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 extended update support long-life add-on
- Versions
- ≥ 0:1.16.1-4.el8_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
- Versions
- ≥ 0:1.16.1-4.el8_6.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 extended update support long-life add-on
- Versions
- ≥ 0:1.16.1-4.el8_6.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 0:1.16.1-4.el8_8.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 0:1.16.1-4.el8_8.5: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:1.22.12-7.el9_8.4: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:1.22.12-6.el9_8.2: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:1.18.4-9.el9_2.6: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 update services for sap solutions
- Versions
- ≥ 0:1.22.1-6.el9_4.7: Not affected (rpm)
No fix published
red hat enterprise linux 9.6 extended update support
- Versions
- ≥ 0:1.22.12-5.el9_6.7: Not affected (rpm)
No fix published
gst-plugins-bad1.0 Debian:12
- Versions
- 1.22.0-4
- 1.22.0-4+deb12u1
- 1.22.0-4+deb12u2
- 1.22.0-4+deb12u3
- 1.22.0-4+deb12u4
- 1.22.0-4+deb12u5
- 1.22.0-4+deb12u6
- 1.22.0-4+deb12u7
- Affected ranges
- ECOSYSTEM: < 1.22.0-4+deb12u8
Update to 1.22.0-4+deb12u8
gst-plugins-bad1.0 Debian:13
- Versions
- 1.26.2-3
- 1.26.2-3+deb13u1
- 1.26.2-3+deb13u2
- Affected ranges
- ECOSYSTEM: < 1.26.2-3+deb13u3
Update to 1.26.2-3+deb13u3
gst-plugins-bad1.0 Debian:14
- Versions
- 1.26.10-1
- 1.26.10-2
- 1.26.2-3
- 1.26.3-1
- 1.26.4-1
- 1.26.5-1
- 1.26.5-2
- 1.26.6-1
- 1.26.6-2
- 1.26.6-3
- 1.26.6-4
- 1.26.6-5
- 1.26.7-1
- 1.26.7-2
- 1.26.8-1
- 1.26.9-1
- 1.27.1-1
- 1.27.2-1
- 1.27.50-1
- 1.27.90-1
- 1.27.90-2
- 1.27.90-3
- 1.28.0-1
- 1.28.1-1
- 1.28.1-2
- 1.28.1-3
- 1.28.2-1
- 1.28.2-2
- 1.28.3-1
- 1.28.4-1
- 1.28.5-1
- 1.28.5-2
- Affected ranges
- ECOSYSTEM: < 1.28.6-1
Update to 1.28.6-1
gst-plugins-bad1.0 Ubuntu:Pro:14.04:LTS
- Versions
- 1.2.0-3ubuntu5
- 1.2.1-1ubuntu1
- 1.2.1-1ubuntu2
- 1.2.2-1ubuntu1
- 1.2.2-1ubuntu2
- 1.2.2-1ubuntu4
- 1.2.3-1ubuntu1
- 1.2.3-1ubuntu2
- 1.2.4-1~ubuntu1
- 1.2.4-1~ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 1.2.4-1~ubuntu1.1+esm1
Update to 1.2.4-1~ubuntu1.1+esm1
gst-plugins-bad1.0 Ubuntu:Pro:16.04:LTS
- Versions
- 1.6.0-1ubuntu1
- 1.6.1-1ubuntu1
- 1.6.2-1ubuntu1
- 1.7.1-1ubuntu1
- 1.7.1-1ubuntu3
- 1.7.1-1ubuntu4
- 1.7.2-1ubuntu1
- 1.7.90-1ubuntu2
- 1.7.91-1ubuntu1
- 1.8.0-1ubuntu1
- 1.8.1-1ubuntu0.1
- 1.8.2-1ubuntu0.1
- 1.8.2-1ubuntu0.2
- 1.8.3-1ubuntu0.2
- 1.8.3-1ubuntu0.2+esm1
- Affected ranges
- ECOSYSTEM: < 1.8.3-1ubuntu0.2+esm2
Update to 1.8.3-1ubuntu0.2+esm2
gst-plugins-bad1.0 Ubuntu:Pro:18.04:LTS
- Versions
- 1.12.3-1ubuntu1
- 1.12.3-1ubuntu2
- 1.12.3-2ubuntu1
- 1.12.4-2ubuntu1
- 1.12.4-2ubuntu2
- 1.13.1-1ubuntu1
- 1.13.91-1ubuntu1
- 1.14.0-1ubuntu1
- 1.14.1-1ubuntu1~ubuntu18.04.1
- 1.14.4-1ubuntu1~ubuntu18.04.1
- 1.14.5-0ubuntu1~18.04.1
- 1.14.5-0ubuntu1~18.04.1+esm1
- Affected ranges
- ECOSYSTEM: < 1.14.5-0ubuntu1~18.04.1+esm2
Update to 1.14.5-0ubuntu1~18.04.1+esm2
gst-plugins-bad1.0 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.1-1ubuntu1
- 1.16.1-1ubuntu3
- 1.16.1-1ubuntu4
- 1.16.1-1ubuntu5
- 1.16.1-1ubuntu6
- 1.16.1-1ubuntu8
- 1.16.2-1ubuntu1
- 1.16.2-1ubuntu2
- 1.16.2-2ubuntu1
- 1.16.2-2.1ubuntu1
- 1.16.3-0ubuntu1
- 1.16.3-0ubuntu1.1
- 1.16.3-0ubuntu1.1+esm1
- Affected ranges
- ECOSYSTEM: < 1.16.3-0ubuntu1.1+esm2
Update to 1.16.3-0ubuntu1.1+esm2
gst-plugins-bad1.0 Ubuntu:Pro:22.04:LTS
- Versions
- 1.18.5-1ubuntu1
- 1.18.5-1ubuntu3
- 1.20.0-2ubuntu2
- 1.20.1-1ubuntu2
- 1.20.3-0ubuntu1
- 1.20.3-0ubuntu1.1
- 1.20.3-0ubuntu1.1+esm2
- Affected ranges
- ECOSYSTEM: < 1.20.3-0ubuntu1.1+esm3
Update to 1.20.3-0ubuntu1.1+esm3
gst-plugins-bad1.0 Ubuntu:Pro:24.04:LTS
- Versions
- 1.22.4-1ubuntu1
- 1.22.4-1ubuntu2
- 1.22.4-1ubuntu4
- 1.22.9-2ubuntu1
- 1.24.0-1ubuntu3
- 1.24.0-1ubuntu4
- 1.24.2-1ubuntu4
- 1.24.2-1ubuntu4+esm1
- Affected ranges
- ECOSYSTEM: < 1.24.2-1ubuntu4+esm2
Update to 1.24.2-1ubuntu4+esm2
Original sources
- https://access.redhat.com/errata/RHSA-2026:55433
- https://access.redhat.com/errata/RHSA-2026:55865
- https://access.redhat.com/errata/RHSA-2026:56521
- https://access.redhat.com/errata/RHSA-2026:65122
- https://access.redhat.com/errata/RHSA-2026:65123
- https://access.redhat.com/errata/RHSA-2026:65124
- https://access.redhat.com/errata/RHSA-2026:66406
- https://access.redhat.com/errata/RHSA-2026:66407
- https://access.redhat.com/errata/RHSA-2026:67151
- https://access.redhat.com/errata/RHSA-2026:67844
- https://access.redhat.com/errata/RHSA-2026:67861
- https://access.redhat.com/security/cve/CVE-2026-19387
- https://bugzilla.redhat.com/show_bug.cgi?id=2513015
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12235
- https://gstreamer.freedesktop.org/releases/1.28/
- https://nvd.nist.gov/vuln/detail/CVE-2026-19387