CVE-2026-53705: Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 blocksamples channels) in gstwavpackdechandleframe() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
Other sources
GStreamer WavPack decoder heap buffer overflow via integer overflow. In gstwavpackdechandleframe() (gstwavpackdec.c), the allocation gmalloc(4 wph.blocksamples dec->channels) uses unchecked 32-bit arithmetic. With blocksamples=0x20000001 and stereo, the multiplication wraps to 8 bytes; WavpackUnpackSamples() then writes ~4 GiB past the allocation. Affects 64-bit RHEL (arithmetic is 32-bit before sizet promotion). Fix pending in GStreamer 1.28.4. Reported via PSIRTSUPT-8879 by Seung Min Shin.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.28.5-1 - Upgrade
Upgrade
GStreamer gst-plugins-good (WavPack audio decoder)to a version that resolves this vulnerability.Fixed in 1.28.4 - Compensating control
Until the fix in GStreamer 1.28.4 is deployed, mitigate exposure by preventing users or applications from opening untrusted/malicious WavPack (.wv) audio files (e.g., block .wv uploads/downloads or disable processing of WavPack content in affected applications).
- Operational
After upgrading to GStreamer 1.28.4, restart affected applications/services and ensure any potentially corrupted state is cleared/reloaded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53705?
The severity of CVE-2026-53705 is classified as high with a CVSS score of 7.6.
What causes CVE-2026-53705?
CVE-2026-53705 is caused by a heap buffer overflow in the WavPack decoder due to an integer overflow during buffer size calculation.
How do I fix CVE-2026-53705?
To fix CVE-2026-53705, update to the latest version of GStreamer that addresses this vulnerability.
What are the potential impacts of CVE-2026-53705?
CVE-2026-53705 can lead to memory corruption, which may allow for arbitrary code execution.
Who is affected by CVE-2026-53705?
Users of GStreamer gstreamer1-plugins-good that process WavPack audio files could be affected by CVE-2026-53705.