CVE-2026-19387: Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
A flaw was found in GStreamer gst-plugins-bad (adpcmdec). The IMA/DVI ADPCM decoder validated the per-block sample count with (nsamples - channels) % 8 == 0, which does not ensure alignment with the decode loop that writes 8 channels samples per iteration. A crafted multi-channel IMA ADPCM WAV can pass this check and cause a heap out-of-bounds write of decoded sample values that are partially derived from attacker-controlled compressed audio data. The adpcmdec element is auto-plugged by decodebin/playbin, so processing untrusted media (players, thumbnailers, transcoders) can trigger the issue, resulting in application crash, denial of service, memory corruption, or potentially code execution. Fixed upstream in gst-plugins-bad 1.28.6 (GStreamer-SA-2026-0077).
Other sources
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gstreamer1-plugins-bad-free (gst-plugins-bad adpcmdec / ima/dvi ADPCM decoder)to a version that resolves this vulnerability.Fixed in 1.28.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GStreamer-SA-2026-0077
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19387?
The severity of CVE-2026-19387 is rated as high with a score of 7.6.
How do I fix CVE-2026-19387?
To fix CVE-2026-19387, update to the latest version of gstreamer1-plugins-bad-free that addresses this vulnerability.
What systems are affected by CVE-2026-19387?
CVE-2026-19387 affects systems using the GStreamer gst-plugins-bad adpcmdec element for decoding IMA/DVI ADPCM audio.
What type of vulnerability is CVE-2026-19387?
CVE-2026-19387 is a heap out-of-bounds write vulnerability caused by insufficient validation of sample counts.
What potential impact does CVE-2026-19387 have?
The impact of CVE-2026-19387 includes the possibility of memory corruption and execution of arbitrary code due to writes beyond the allocated output buffer.