{"id":"CVE-2026-1940","title":"Gstreamer: incomplete fix of cve-2026-1940","summary":"An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual o…","severity":"medium","cvss":5.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","vendor":"Red Hat","product":"gstreamer1","affected":["gstreamer1 (all versions)","gstreamer","gstreamer (all versions)","gstreamer1 (all versions)","gstreamer1 (all versions)","mingw-gstreamer1 (all versions)","gstreamer1 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-03-24T13:43:35.376273Z"},"published":"2026-03-23","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:23:49.220Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-1940","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-1940"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436932","label":"RHBZ#2436932"},{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854"},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0001.html"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1940"}],"tags":["cve.org"],"epss":0.00234,"epssPercentile":0.14321,"ingestedAt":"2026-11-05T22:38:31.533Z","slug":"CVE-2026-1940","body":"## Overview\n\nAn incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.\n\n## Affected\n\n- `gstreamer1 (all versions)`\n- `gstreamer`\n- `gstreamer (all versions)`\n- `gstreamer1 (all versions)`\n- `gstreamer1 (all versions)`\n- `mingw-gstreamer1 (all versions)`\n- `gstreamer1 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}