Every CVE Search/ Get API key

CVE-2026-1940

Gstreamer: incomplete fix of cve-2026-1940

5.1 MediumFix available

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.23%Up 0.2 points since Mar 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

Gstreamer: incomplete fix of cve-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
CVE-2026-1940
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-125
Updated
2026-11-05
EUVDEUVD-2026-14551 5.1

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
EUVD-2026-14551
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-05
GitHub AdvisoriesGHSA-9wvw-r6fm-6wwv 5.1

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk()...

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
GHSA-9wvw-r6fm-6wwv
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 5.1

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
CVE-2026-1940
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-05
OSV 5.1

Gstreamer: incomplete fix of cve-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
CVE-2026-1940
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-07
OSVDEBIAN-CVE-2026-1940 7.5

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
DEBIAN-CVE-2026-1940
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2026-2146 5.1

gstreamer1-plugins-good security update

Security Fix(es):

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.(CVE-2026-1940)

Record
OESA-2026-2146
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-1940 7.5

CVE-2026-1940 in gst-plugins-good1.0 - Patched by Root

Root has patched CVE-2026-1940 in the gst-plugins-good1.0 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-1940
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-1940 5.1

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Record
UBUNTU-CVE-2026-1940
CVSS 3.1
5.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1792572593 No score

gstreamer1-plugins-good: Fix of 3 CVEs

  • CVE-2026-46469: avoid division by zero in qtdemux_parse_trak when zero audio channels are signalled
  • CVE-2026-46470: avoid division by zero in qtdemux_audio_caps when zero audio channels are signalled for raw LPCM
  • CVE-2026-1940: fix out-of-bounds read in gst_wavparse_adtl_chunk on odd-sized adtl sub-chunks
Record
CLSA-2026-1792572593
Updated
2026-11-02
OSVMGASA-2026-0222 No score

Updated gstreamer1.0-plugins-bad, gstreamer1.0-plugins-base, gstreamer1.0-plugins-good & gstreamer1.0-plugins-ugly packages fix security vulnerabilities

CVE-2026-2921, GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability CVE-2026-2923.GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability CVE-2026-3082, GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-3085, GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-2920, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-2922, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-1940, Gstreamer: incomplete fix of CVE-2026-1940

Record
MGASA-2026-0222
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gstreamer1-plugins-good
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.22.12-4.el9.tuxcare.els6
1.22.12-4.el9.tuxcare.els6
gstreamer1-plugins-good-gtk
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.22.12-4.el9.tuxcare.els6
1.22.12-4.el9.tuxcare.els6
gstreamer1-plugins-good-qt
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.22.12-4.el9.tuxcare.els6
1.22.12-4.el9.tuxcare.els6
gst-plugins-good1.0
Debian:12
 before 1.22.0-5+deb12u4, plus listed versions
1.22.0-51.22.0-5+deb12u11.22.0-5+deb12u21.22.0-5+deb12u3
1.22.0-5+deb12u4
gst-plugins-good1.0
Debian:13
 before 1.26.2-1+deb13u2, plus listed versions
1.26.2-11.26.2-1+deb13u1
1.26.2-1+deb13u2
gst-plugins-good1.0
Debian:14
 before 1.28.1-1, plus listed versions
1.26.10-11.26.2-11.26.3-11.26.4-11.26.5-1
Show 13 moreShow less
1.26.5-21.26.5-2+hurd.11.26.5-31.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-1
1.28.1-1
gstreamer1.0-plugins-bad
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9
1.22.11-1.2.mga9
gstreamer1.0-plugins-base
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.3.mga9
1.22.11-1.3.mga9
gstreamer1.0-plugins-good
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9
1.22.11-1.2.mga9
gstreamer1.0-plugins-ugly
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.1.mga9
1.22.11-1.1.mga9
Show 14 moreShow less
Affected packages
PackageAffectedFixed
gstreamer1.0-plugins-bad
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.2.mga9.tainted
1.22.11-1.2.mga9.tainted
gstreamer1.0-plugins-ugly
Mageia:9
From an advisory covering 8 CVEs
 before 1.22.11-1.1.mga9.tainted
1.22.11-1.1.mga9.tainted
gstreamer1-plugins-good
openEuler:20.03-LTS-SP4
 before 1.16.2-12.oe2003sp4
1.16.2-12.oe2003sp4
gstreamer1-plugins-good
openEuler:22.03-LTS-SP4
 before 1.16.2-12.oe2203sp4
1.16.2-12.oe2203sp4
gstreamer1-plugins-good
openEuler:24.03-LTS
 before 1.20.3-8.oe2403sp3
1.20.3-8.oe2403sp3
gstreamer1-plugins-good
openEuler:24.03-LTS-SP1
 before 1.20.3-8.oe2403sp1
1.20.3-8.oe2403sp1
gstreamer1-plugins-good
openEuler:24.03-LTS-SP3
 before 1.20.3-8.oe2403sp3
1.20.3-8.oe2403sp3
gst-plugins-bad1.0
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.2.0-3ubuntu51.2.1-1ubuntu11.2.1-1ubuntu21.2.2-1ubuntu11.2.2-1ubuntu2
Show 6 moreShow less
1.2.2-1ubuntu41.2.3-1ubuntu11.2.3-1ubuntu21.2.4-1~ubuntu11.2.4-1~ubuntu1.11.2.4-1~ubuntu1.1+esm1
 None known
gst-plugins-bad1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3
Show 11 moreShow less
1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.21.8.3-1ubuntu0.2+esm11.8.3-1ubuntu0.2+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2
Show 8 moreShow less
1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm11.14.5-0ubuntu1~18.04.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6
Show 9 moreShow less
1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.1+esm11.16.3-0ubuntu1.1+esm2
 None known
gst-plugins-bad1.0
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.1+esm21.20.3-0ubuntu1.1+esm3
 None known
gst-plugins-bad1.0
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu3
Show 4 moreShow less
1.24.0-1ubuntu41.24.2-1ubuntu41.24.2-1ubuntu4+esm11.24.2-1ubuntu4+esm2
 None known
gst-plugins-bad1.0
Ubuntu:25.10
 All versions, plus listed versions
1.26.0-1ubuntu21.26.2-1ubuntu11.26.3-1ubuntu11.26.4-1ubuntu11.26.5-1ubuntu2
 None known

History

History
RecordedChangedSources
affectedCVE List, NVD
factsEUVD
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1940 is a medium vulnerability (CVSS 5.1) in Gstreamer, published March 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in gst-plugins-good1.0 1.22.0-5+deb12u4.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open