CVE-2026-19387
Received Received - Intake

Heap Out-of-Bounds Write in GStreamer gst-plugins-bad adpcmdec

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19387
EUVD
EUVD-2026-54986

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gstreamer gst-plugins-bad 1.28.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19387 is a heap out-of-bounds write vulnerability in GStreamer's gst-plugins-bad package, specifically in the adpcmdec IMA/DVI ADPCM decoder. It occurs due to improper validation of the per-block sample count for multi-channel streams. A crafted WAV file can bypass checks, causing writes beyond the allocated output buffer. This may lead to crashes, denial of service, memory corruption, or code execution.

Detection Guidance

To detect this vulnerability, check the version of gst-plugins-bad installed on your system. If it is older than 1.28.6, the system is vulnerable. Run: gst-inspect-1.0 --version to check the version. Also monitor for crashes or memory corruption when processing IMA/DVI ADPCM WAV files.

Impact Analysis

If you process untrusted media files, this vulnerability could allow attackers to crash applications, cause denial of service, corrupt memory, or execute arbitrary code. Since the adpcmdec element is auto-plugged by decodebin/playbin, media players, thumbnailers, or transcoders handling untrusted files are at risk.

Compliance Impact

This vulnerability primarily affects media processing applications that handle untrusted audio files. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance by enabling arbitrary code execution or memory corruption when processing untrusted media. Organizations handling sensitive data under these regulations should ensure affected GStreamer components are updated to patched versions to prevent potential security breaches.

Mitigation Strategies

Update gst-plugins-bad to version 1.28.6 or later. Avoid processing untrusted multi-channel IMA ADPCM WAV files. Sandbox applications that handle untrusted media to limit potential damage from exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart