Security Advisory 2026-0064
| Summary | NULL pointer dereference in WAV parser during adtl chunk parsing in streaming mode |
| Date | 2026-07-08 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.5 |
| IDs | GStreamer-SA-2026-0064 |
Details
A NULL pointer dereference vulnerability in the WAV parser (wavparse) in gst-plugins-good when processing crafted WAV files in streaming (push) mode. The streaming handler for LIST/adtl chunks maps the chunk buffer using the attacker-declared size without first verifying that sufficient data is available. When fewer bytes are buffered than declared, the mapping operation returns NULL, which is subsequently dereferenced during chunk parsing without a NULL check.
This is distinct from CVE-2026-1940 (GST-SA-2026-0001), which addressed an out-of-bounds read inside the adtl chunk parser but did not add the availability guard on the streaming caller side.
Impact
A malicious third party could trigger a crash of the application by supplying a crafted WAV file with an over-declared adtl chunk size, resulting in denial of service. Because push mode is used by network source elements such as HTTP sources like souphttpsrc, the vulnerability can be exploited remotely by an unauthenticated server delivering a small crafted file to a receiving application.
Solution
The gst-plugins-good 1.28.5 release addresses the issue by adding a data availability check before mapping adtl chunk data in streaming mode, consistent with the existing guard used for LIST/INFO chunks.
People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending