Out-of-bounds read in gst-plugins-bad and gstreamer - CVE-2026-1940

Vulnerability identifier: #VU132153

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-1940

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in WAV parser when parsing crafted WAV input files. A remote attacker can supply a specially crafted input file to cause a denial of service.

gst-plugins-bad
gstreamer
Debian Linux
openEuler
gstreamer1-plugins-good
gstreamer1-plugins-good-debuginfo
gstreamer1-plugins-good-debugsource
gstreamer1-plugins-good-gtk
gstreamer1-plugins-good-help
gst-plugins-good1.0 (Debian package)

Install security update from vendor's website.

gst-plugins-bad - update to 1.28.1
gstreamer - update to 1.28.1
gstreamer1-plugins-good - update to 1.16.2-12
gstreamer1-plugins-good-debuginfo - update to 1.16.2-12
gstreamer1-plugins-good-debugsource - update to 1.16.2-12
gstreamer1-plugins-good-gtk - update to 1.16.2-12
gstreamer1-plugins-good-help - update to 1.16.2-12
gst-plugins-good1.0 (Debian package) - update to 1.26.2-1+deb13u2

• https://gstreamer.freedesktop.org/security/sa-2026-0001.html

• openEuler update for gstreamer1-plugins-good
• Debian update for gst-plugins-good1.0