UBUNTU-CVE-2026-53705: Integer Overflow
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 blocksamples channels) in gstwavpackdechandleframe() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.5+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.14.5-0ubuntu1~18.04.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.16.3-0ubuntu1.3+esm5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.20.3-0ubuntu1.7 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.24.2-1ubuntu1.5 - Upgrade
Upgrade
ubuntu/gst-plugins-good1.0to a version that resolves this vulnerability.Fixed in 1.28.2-2ubuntu0.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the GStreamer WavPack decoder from gst-plugins-good1.0 are exposed when they process WavPack audio files. Both 32-bit and 64-bit systems are affected.
What does an attacker need to exploit it?
An attacker needs to persuade a user to open a specially crafted WavPack audio file in an affected application. No attacker privileges are required, but user interaction is required.
What can happen if exploitation succeeds?
The malformed file can cause heap memory corruption because decoded samples are written beyond a too-small allocation. This can crash the application and may allow arbitrary code execution.