CVE-2026-53705

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

This flaw affects gstreamer1-plugins-good as shipped in Red Hat Enterprise Linux. The integer overflow in the buffer size calculation affects 64-bit systems the same way it does 32-bit platforms, as the multiplication is performed in 32-bit integer arithmetic before promotion to size_t for g_malloc(). WavPack is an uncommon audio format not typically used for streaming, so exploitation generally requires user interaction to open a malicious file. The fix is expected in upstream GStreamer 1.28.4.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.