Yüksek CVSS 7.5
CVE-2026-1940: Gst-plugins-good: sınır dışı okuma
Açıklama (NVD)
An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.
Özet bilgiler
- Ürün
- Freedesktop Gst-plugins-good
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %0,23 (yüzdelik 14)
- CWE
- CWE-125
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| freedesktop-gst-plugins-good | 1.0.0 | 1.0.0 | — |
| gstreamer-gstreamer | — | — | 1.28.1 |
| debian-debian-linux | 11.0 | 11.0 | — |
| debian-debian-linux | 12.0 | 12.0 | — |
| redhat-enterprise-linux | 7.0 | 7.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux | 10.0 | 10.0 | — |