Description
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.
References (5)
Core 5
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry
x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-1940
Issue Tracking, X_Refsource_Redhat issue-tracking
x_refsource_redhat
RHBZ#2436932
https://bugzilla.redhat.com/show_bug.cgi?id=2436932
Scores
CVSS v3
5.1
EPSS
0.0022
EPSS Percentile
12.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (13)
debian/debian_linux
11.0
debian/debian_linux
12.0
freedesktop/gst-plugins-good
1.0.0
gstreamer/gstreamer
< 1.28.1
Red Hat/Red Hat Enterprise Linux 10
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7
Red Hat/Red Hat Enterprise Linux 8
Red Hat/Red Hat Enterprise Linux 9
redhat/enterprise_linux
7.0
... and 3 more
Published
Mar 23, 2026
Tracked Since
Mar 24, 2026