Security Advisory 2026-0077

Details

A heap out-of-bounds write vulnerability in the adpcmdec element (IMA/DVI ADPCM audio decoder) in gst-plugins-bad. The decoder validates the per-block sample count using an incorrect check that does not account for multi-channel streams. Crafted WAV files with misaligned block sizes pass this insufficient validation, causing the decode loop to write beyond the allocated output buffer. The overwritten values are partially derived from the compressed audio data in the input file.

Impact

A malicious third party could trigger a heap out-of-bounds write by providing a crafted IMA ADPCM WAV file. Since the adpcmdec element is auto-plugged by decodebin and playbin, merely opening or previewing such a file in a media player, file manager thumbnailer, or server-side transcoder is sufficient to trigger the vulnerability. This can result in application crash, denial of service, data corruption, or potentially arbitrary code execution.

Solution

The gst-plugins-bad 1.28.6 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.6 release

• Release Notes
• GStreamer Plugins Bad 1.28.6

Patches

• Patch