{"id":"CVE-2026-1940","aliases":["CLSA-2026-1792572593","DEBIAN-CVE-2026-1940","EUVD-2026-14551","GHSA-9wvw-r6fm-6wwv","MGASA-2026-0222","OESA-2026-2146","ROOT-OS-DEBIAN-12-CVE-2026-1940","UBUNTU-CVE-2026-1940"],"status":"published","title":"Gstreamer: incomplete fix of cve-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00239,"percentile":0.15014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-03-23T21:26:14Z","modified":"2026-11-05T20:17:56Z","fixes":[{"ecosystem":"Debian:12","package":"gst-plugins-good1.0","fixed_in":["1.22.0-5+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gst-plugins-good1.0","fixed_in":["1.26.2-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gst-plugins-good1.0","fixed_in":["1.28.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-good","fixed_in":["1.16.2-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","fixed_in":["1.16.2-12.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-good","fixed_in":["1.20.3-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-good","fixed_in":["1.20.3-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-good","fixed_in":["1.20.3-8.oe2403sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gstreamer1-plugins-good-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.12-4.el9.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-5+deb12u4"}]}],"versions":["1.22.0-5","1.22.0-5+deb12u1","1.22.0-5+deb12u2","1.22.0-5+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-1+deb13u2"}]}],"versions":["1.26.2-1","1.26.2-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"gst-plugins-good1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.1-1"}]}],"versions":["1.26.10-1","1.26.2-1","1.26.3-1","1.26.4-1","1.26.5-1","1.26.5-2","1.26.5-2+hurd.1","1.26.5-3","1.26.6-1","1.26.7-1","1.26.8-1","1.26.9-1","1.27.1-1","1.27.2-1","1.27.50-1","1.27.50-2","1.27.90-1","1.28.0-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.2.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.3.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.2.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.2.mga9.tainted"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"gstreamer1.0-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.11-1.1.mga9.tainted"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-12.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gstreamer1-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-3ubuntu5","1.2.1-1ubuntu1","1.2.1-1ubuntu2","1.2.2-1ubuntu1","1.2.2-1ubuntu2","1.2.2-1ubuntu4","1.2.3-1ubuntu1","1.2.3-1ubuntu2","1.2.4-1~ubuntu1","1.2.4-1~ubuntu1.1","1.2.4-1~ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu1","1.6.1-1ubuntu1","1.6.2-1ubuntu1","1.7.1-1ubuntu1","1.7.1-1ubuntu3","1.7.1-1ubuntu4","1.7.2-1ubuntu1","1.7.90-1ubuntu2","1.7.91-1ubuntu1","1.8.0-1ubuntu1","1.8.1-1ubuntu0.1","1.8.2-1ubuntu0.1","1.8.2-1ubuntu0.2","1.8.3-1ubuntu0.2","1.8.3-1ubuntu0.2+esm1","1.8.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.3-1ubuntu1","1.12.3-1ubuntu2","1.12.3-2ubuntu1","1.12.4-2ubuntu1","1.12.4-2ubuntu2","1.13.1-1ubuntu1","1.13.91-1ubuntu1","1.14.0-1ubuntu1","1.14.1-1ubuntu1~ubuntu18.04.1","1.14.4-1ubuntu1~ubuntu18.04.1","1.14.5-0ubuntu1~18.04.1","1.14.5-0ubuntu1~18.04.1+esm1","1.14.5-0ubuntu1~18.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1ubuntu1","1.16.1-1ubuntu3","1.16.1-1ubuntu4","1.16.1-1ubuntu5","1.16.1-1ubuntu6","1.16.1-1ubuntu8","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-2ubuntu1","1.16.2-2.1ubuntu1","1.16.3-0ubuntu1","1.16.3-0ubuntu1.1","1.16.3-0ubuntu1.1+esm1","1.16.3-0ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.5-1ubuntu1","1.18.5-1ubuntu3","1.20.0-2ubuntu2","1.20.1-1ubuntu2","1.20.3-0ubuntu1","1.20.3-0ubuntu1.1","1.20.3-0ubuntu1.1+esm2","1.20.3-0ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.4-1ubuntu1","1.22.4-1ubuntu2","1.22.4-1ubuntu4","1.22.9-2ubuntu1","1.24.0-1ubuntu3","1.24.0-1ubuntu4","1.24.2-1ubuntu4","1.24.2-1ubuntu4+esm1","1.24.2-1ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gst-plugins-bad1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1ubuntu2","1.26.2-1ubuntu1","1.26.3-1ubuntu1","1.26.4-1ubuntu1","1.26.5-1ubuntu2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"freedesktop","product":"gst-plugins-good"},{"vendor":"gstreamer","product":"gstreamer"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-1940","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436932","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854","tags":["Broken Link","report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0001.html","tags":["Vendor Advisory","web","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1940","tags":["Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1940","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9wvw-r6fm-6wwv"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792572593.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46470","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1940.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0222.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35216","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00076.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00100.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2146","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1940","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-1940","title":"Gstreamer: incomplete fix of cve-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T21:26:14.719Z","modified":"2026-11-05T19:23:49.22Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T20:54:59.423743Z"}],"euvd":[{"id":"EUVD-2026-14551","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T21:26:14Z","modified":"2026-11-05T19:23:49Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T20:01:48.21368Z"}],"ghsa":[{"id":"GHSA-9wvw-r6fm-6wwv","title":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk()...","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-24T00:30:24Z","modified":"2026-03-24T15:31:31Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:06:50.028669Z"}],"nvd":[{"id":"CVE-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T22:16:25.043Z","modified":"2026-11-05T20:17:56.067Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T21:56:41.057422Z"}],"osv":[{"id":"CVE-2026-1940","title":"Gstreamer: incomplete fix of cve-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T21:26:14.719Z","modified":"2026-11-07T02:30:28.012838597Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-07T03:08:02.440811Z"},{"id":"DEBIAN-CVE-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T22:16:25.043Z","modified":"2026-10-15T18:00:09.477650615Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-2146","title":"gstreamer1-plugins-good security update","description":"Security Fix(es):\n\nAn incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u0026gt; size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.(CVE-2026-1940)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.260703318Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-1940","title":"CVE-2026-1940 in gst-plugins-good1.0 - Patched by Root","description":"Root has patched CVE-2026-1940 in the gst-plugins-good1.0 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T10:46:11Z","modified":"2026-10-16T13:00:08.718924088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"UBUNTU-CVE-2026-1940","description":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 \u003e size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.","status":"published","published":"2026-03-23T22:16:00Z","modified":"2026-10-01T00:21:06.580251709Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"CLSA-2026-1792572593","title":"gstreamer1-plugins-good: Fix of 3 CVEs","description":"- CVE-2026-46469: avoid division by zero in qtdemux_parse_trak when zero audio\n  channels are signalled\n- CVE-2026-46470: avoid division by zero in qtdemux_audio_caps when zero audio\n  channels are signalled for raw LPCM\n- CVE-2026-1940: fix out-of-bounds read in gst_wavparse_adtl_chunk on odd-sized\n  adtl sub-chunks","status":"published","published":"2026-10-21T08:50:04Z","modified":"2026-10-26T09:43:31.500578273Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0222","title":"Updated gstreamer1.0-plugins-bad, gstreamer1.0-plugins-base, gstreamer1.0-plugins-good \u0026 gstreamer1.0-plugins-ugly packages fix security vulnerabilities","description":"CVE-2026-2921, GStreamer RIFF Palette Integer Overflow Remote Code\nExecution Vulnerability\nCVE-2026-2923.GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code\nExecution Vulnerability\nCVE-2026-3082, GStreamer JPEG Parser Heap-based Buffer Overflow Remote\nCode Execution Vulnerability\nCVE-2026-3085, GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote\nCode Execution Vulnerability\nCVE-2026-2920, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote\nCode Execution Vulnerability\nCVE-2026-2922, GStreamer ASF Demuxer Heap-based Buffer Overflow Remote\nCode Execution Vulnerability\nCVE-2026-1940, Gstreamer: incomplete fix of CVE-2026-1940\n","status":"published","published":"2026-06-18T18:04:49Z","modified":"2026-06-18T18:34:11.397570106Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}