CVE-2026-19387: GStreamer Buffer Overflow Vulnerability

CVE-2026-19387 Overview

CVE-2026-19387 is a heap out-of-bounds write vulnerability in the GStreamer gst-plugins-badadpcmdec element. The flaw occurs when the decoder processes IMA/DVI ADPCM audio inside a crafted WAV file. Insufficient validation of the per-block sample count for multi-channel streams allows writes beyond the allocated output buffer. Consequences include application crash, denial of service, memory corruption, and potentially arbitrary code execution when untrusted media is processed. The weakness is tracked as [CWE-787].

Critical Impact
Processing a malicious WAV file through a GStreamer-based pipeline can corrupt heap memory and lead to arbitrary code execution in the context of the media application.

Affected Products

GStreamer gst-plugins-bad (adpcmdec element)
Linux distributions bundling vulnerable GStreamer builds, including Red Hat products
Applications and media frameworks that use GStreamer pipelines to decode WAV/ADPCM audio

Discovery Timeline

2026-08-10 - CVE-2026-19387 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19387

Vulnerability Analysis

The adpcmdec element in gst-plugins-bad decodes Adaptive Differential Pulse Code Modulation (ADPCM) audio, including the IMA/DVI variant carried inside WAV containers. The decoder allocates an output buffer sized from block and channel parameters read from the input file. It then decodes samples block by block into that buffer.

For multi-channel streams, the decoder does not adequately validate the declared per-block sample count against the size of the allocated output buffer. A crafted WAV file can declare a sample count that exceeds the buffer capacity, causing the decoding loop to write past the end of the heap allocation. The out-of-bounds write corrupts adjacent heap metadata and data structures.

The crash path yields denial of service. On systems where the heap layout can be shaped through prior allocations, the write primitive may be steered to overwrite function pointers or vtables, enabling arbitrary code execution in the process handling the media.

Root Cause

The root cause is missing bounds validation in the IMA/DVI ADPCM decode routine of the adpcmdec element. The output buffer size is derived from container metadata, but the per-block sample count used by the decode loop is trusted without cross-checking against the allocated capacity for multi-channel layouts.

Attack Vector

Exploitation requires an attacker to deliver a crafted WAV file to a target that decodes it with a vulnerable GStreamer pipeline. This can occur through web browsers, email clients, chat applications, file managers with thumbnailing, or media players that hand audio to GStreamer. The attack is network-reachable and requires a single user action to open or preview the file.

Refer to the Red Hat CVE Advisory, the Red Hat Bug Report, and the upstream GitLab Merge Request for the fix details.

Detection Methods for CVE-2026-19387

Indicators of Compromise

Unexpected crashes of media applications, browsers, or file-manager thumbnailer processes when previewing WAV files.
Core dumps or AddressSanitizer reports referencing adpcmdec or gst-plugins-bad frames.
Delivery of WAV files with anomalous IMA/DVI ADPCM headers, including inflated per-block sample counts relative to declared block size and channel count.

Detection Strategies

Inventory hosts for installed gst-plugins-bad package versions and compare against fixed builds referenced in the GStreamer 1.28 release notes.
Inspect email and web gateways for WAV attachments and use content parsers to flag malformed ADPCM fmt chunks.
Correlate media-application crash telemetry with recent WAV file access events.

Monitoring Recommendations

Alert on repeated segmentation faults in GStreamer-linked processes such as gst-launch-1.0, totem, rhythmbox, nautilus, and browser sandbox helpers.
Ingest package inventory and endpoint crash telemetry into a centralized data lake to identify unpatched hosts and clustered failures.
Track downloads of WAV files from untrusted domains and correlate with subsequent process crashes on the receiving host.

How to Mitigate CVE-2026-19387

Immediate Actions Required

Apply the patched gst-plugins-bad packages provided by your Linux distribution as soon as they are available.
Restrict automatic media previewing and thumbnailing on multi-user and internet-facing systems until patching is complete.
Block or quarantine WAV attachments from untrusted senders at the mail gateway.

Patch Information

The upstream fix is tracked in the GStreamer merge request 12235 and is included in the GStreamer 1.28 release series. Vendor packages should be updated to versions that incorporate this fix. Red Hat customers should consult the Red Hat CVE Advisory for product-specific errata.

Workarounds

Disable or remove the adpcmdec element from GStreamer plugin paths on systems that do not require ADPCM decoding.
Configure media applications to reject WAV files sourced from untrusted locations pending patch deployment.
Run media-processing services under seccomp or sandbox profiles that constrain the impact of memory corruption.

bash

# Configuration example: remove the vulnerable plugin binary until patched
sudo mv /usr/lib64/gstreamer-1.0/libgstadpcmdec.so \
        /usr/lib64/gstreamer-1.0/libgstadpcmdec.so.disabled

# Verify the element is no longer registered
gst-inspect-1.0 adpcmdec || echo "adpcmdec disabled"