CVE-2026-1940: Gstreamer: incomplete fix of cve-2026-1940
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1940?
CVE-2026-1940 has a moderate severity level due to the potential for out-of-bounds reads affecting application stability.
How do I fix CVE-2026-1940?
To resolve CVE-2026-1940, upgrade GStreamer to version 1.28.2 or later, or apply the necessary patches provided by your distribution.
Which versions of GStreamer are affected by CVE-2026-1940?
CVE-2026-1940 affects GStreamer versions up to 1.28.1.
What functions are involved in CVE-2026-1940?
CVE-2026-1940 involves the gst_wavparse_adtl_chunk() function, which has an incomplete fix related to size validation.
Are there any workarounds for CVE-2026-1940?
There are no officially recommended workarounds for CVE-2026-1940; upgrading to a patched version is the best mitigation.