CVE-2026-1940

Katalog CVE

CVSS 7.5 · High EPSS 0,22%

Kerentanan Out-of-bounds Read pada freedesktop gst-plugins-good, gstreamer +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-1940 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2436932 issue tracking · advisory vendor
• https://gstreamer.freedesktop.org/security/sa-2026-0001.html advisory vendor
• https://security-tracker.debian.org/tracker/CVE-2026-1940 advisory pihak ketiga
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 broken link