---
id: CVE-2026-1940
title: 'Gstreamer: incomplete fix of cve-2026-1940'
summary: >-
  An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in
  gst_wavparse_adtl_chunk() function. The patch added a size validation check
  lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used
  in the actual o…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
vendor: Red Hat
product: gstreamer1
affected:
  - gstreamer1 (all versions)
  - gstreamer
  - gstreamer (all versions)
  - gstreamer1 (all versions)
  - gstreamer1 (all versions)
  - mingw-gstreamer1 (all versions)
  - gstreamer1 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-24T13:43:35.376273Z'
published: '2026-03-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:23:49.220Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-1940'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-1940'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2436932'
    label: RHBZ#2436932
  - url: 'https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854'
  - url: 'https://gstreamer.freedesktop.org/security/sa-2026-0001.html'
  - url: 'https://security-tracker.debian.org/tracker/CVE-2026-1940'
tags:
  - cve.org
epss: 0.00234
epssPercentile: 0.14321
ingestedAt: '2026-11-05T22:38:31.533Z'
---

## Overview

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

## Affected

- `gstreamer1 (all versions)`
- `gstreamer`
- `gstreamer (all versions)`
- `gstreamer1 (all versions)`
- `gstreamer1 (all versions)`
- `mingw-gstreamer1 (all versions)`
- `gstreamer1 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.