ZeroDay Findings
Sign inSign up

Findings

CVE-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function.

Published Mar 23, 2026 · updated Oct 15, 2026 · freedesktop gst-plugins-good

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 23, 2026 · NIST NVD

    Detected

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

  2. Jun 17, 2026 · NIST NVD

    Updated

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

  3. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.22.0-5+deb12u4; gst-plugins-good1.0 fixed in 1.26.2-1+deb13u2; gst-plugins-good1.0 fixed in 1.28.1-1

  4. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.22.0-5+deb12u4

  5. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.26.2-1+deb13u2

  6. Oct 15, 2026 · OSV.dev

    Fix available

    gst-plugins-good1.0 fixed in 1.28.1-1

  7. Oct 15, 2026 · OSV.dev

    Updated

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Affected

  • Debian:12 gst-plugins-good1.00 → 1.22.0-5+deb12u4
  • Debian:13 gst-plugins-good1.00 → 1.26.2-1+deb13u2
  • Debian:14 gst-plugins-good1.00 → 1.28.1-1
  • cpe debian/debian linux11.0
  • cpe debian/debian linux12.0
  • cpe freedesktop/gst-plugins-good1.0.0
  • cpe gstreamer/gstreamerversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0

Sources

  • CVE.orgVulnerability recordCVE-2026-1940

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-1940

    An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd num

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-1940
    osv.dev

References