Security Advisory 2026-0064

Details

A NULL pointer dereference vulnerability in the WAV parser (wavparse) in gst-plugins-good when processing crafted WAV files in streaming (push) mode. The streaming handler for LIST/adtl chunks maps the chunk buffer using the attacker-declared size without first verifying that sufficient data is available. When fewer bytes are buffered than declared, the mapping operation returns NULL, which is subsequently dereferenced during chunk parsing without a NULL check.

This is distinct from CVE-2026-1940 (GST-SA-2026-0001), which addressed an out-of-bounds read inside the adtl chunk parser but did not add the availability guard on the streaming caller side.

Impact

A malicious third party could trigger a crash of the application by supplying a crafted WAV file with an over-declared adtl chunk size, resulting in denial of service. Because push mode is used by network source elements such as HTTP sources like souphttpsrc, the vulnerability can be exploited remotely by an unauthenticated server delivering a small crafted file to a receiving application.

Solution

The gst-plugins-good 1.28.5 release addresses the issue by adding a data availability check before mapping adtl chunk data in streaming mode, consistent with the existing guard used for LIST/INFO chunks.

People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.5 release

• Release Notes
• GStreamer Plugins Good 1.28.5

Patches

• Patch