Vulnerability-Lookup

SUSE-SU-2026:2727-1

Vulnerability from csaf_suse - Published: 2026-07-02 14:04 - Updated: 2026-07-02 14:04

Summary

Security update for gstreamer-plugins-good

Severity

Important

Notes

Title of the patch: Security update for gstreamer-plugins-good

Description of the patch: This update for gstreamer-plugins-good fixes the following issues - CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421). - CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).

Patchnames: SUSE-2026-2727,SUSE-SLE-SERVER-12-SP5-LTSS-2026-2727,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-2727

CVE-2024-47540

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix

Threats

Impact important

CVE-2026-53705

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch	—	Vendor Fix

Threats

Impact important

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1234421	self
https://bugzilla.suse.com/1268449	self
https://www.suse.com/security/cve/CVE-2024-47540/	self
https://www.suse.com/security/cve/CVE-2026-53705/	self
https://www.suse.com/security/cve/CVE-2024-47540	external
https://bugzilla.suse.com/1234421	external
https://www.suse.com/security/cve/CVE-2026-53705	external
https://bugzilla.suse.com/1268449	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for gstreamer-plugins-good",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for gstreamer-plugins-good fixes the following issues\n\n- CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).\n- CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-2727,SUSE-SLE-SERVER-12-SP5-LTSS-2026-2727,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-2727",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2727-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:2727-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20262727-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:2727-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047853.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1234421",
        "url": "https://bugzilla.suse.com/1234421"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268449",
        "url": "https://bugzilla.suse.com/1268449"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-47540 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-47540/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53705 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53705/"
      }
    ],
    "title": "Security update for gstreamer-plugins-good",
    "tracking": {
      "current_release_date": "2026-07-02T14:04:37Z",
      "generator": {
        "date": "2026-07-02T14:04:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:2727-1",
      "initial_release_date": "2026-07-02T14:04:37Z",
      "revision_history": [
        {
          "date": "2026-07-02T14:04:37Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.aarch64",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.aarch64",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.aarch64",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.aarch64",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-64bit-1.8.3-16.19.1.aarch64_ilp32",
                "product": {
                  "name": "gstreamer-plugins-good-64bit-1.8.3-16.19.1.aarch64_ilp32",
                  "product_id": "gstreamer-plugins-good-64bit-1.8.3-16.19.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-64bit-1.8.3-16.19.1.aarch64_ilp32",
                "product": {
                  "name": "gstreamer-plugins-good-extra-64bit-1.8.3-16.19.1.aarch64_ilp32",
                  "product_id": "gstreamer-plugins-good-extra-64bit-1.8.3-16.19.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.i586",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.i586",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.i586",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.i586",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.i586",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.i586",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
                "product": {
                  "name": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
                  "product_id": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.ppc64le",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.ppc64le",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.ppc64le",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.ppc64le",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390x",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390x",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.s390x",
                "product": {
                  "name": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.s390x",
                  "product_id": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390x",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390x",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390x",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390x",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.s390x",
                "product": {
                  "name": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.s390x",
                  "product_id": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
                "product": {
                  "name": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
                  "product_id": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.x86_64",
                "product": {
                  "name": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.x86_64",
                  "product_id": "gstreamer-plugins-good-32bit-1.8.3-16.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.x86_64",
                "product": {
                  "name": "gstreamer-plugins-good-doc-1.8.3-16.19.1.x86_64",
                  "product_id": "gstreamer-plugins-good-doc-1.8.3-16.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.x86_64",
                "product": {
                  "name": "gstreamer-plugins-good-extra-1.8.3-16.19.1.x86_64",
                  "product_id": "gstreamer-plugins-good-extra-1.8.3-16.19.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.x86_64",
                "product": {
                  "name": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.x86_64",
                  "product_id": "gstreamer-plugins-good-extra-32bit-1.8.3-16.19.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
        },
        "product_reference": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.s390x as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
        },
        "product_reference": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64"
        },
        "product_reference": "gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
        },
        "product_reference": "gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47540",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-47540"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size \u003c 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem-\u003eallocator-\u003emem_unmap_full or mem-\u003eallocator-\u003emem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-47540",
          "url": "https://www.suse.com/security/cve/CVE-2024-47540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234421 for CVE-2024-47540",
          "url": "https://bugzilla.suse.com/1234421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T14:04:37Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-47540"
    },
    {
      "cve": "CVE-2026-53705",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53705"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in GStreamer\u0027s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53705",
          "url": "https://www.suse.com/security/cve/CVE-2026-53705"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268449 for CVE-2026-53705",
          "url": "https://bugzilla.suse.com/1268449"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5-LTSS:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-1.8.3-16.19.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gstreamer-plugins-good-lang-1.8.3-16.19.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-02T14:04:37Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53705"
    }
  ]
}

CVE-2024-47540 (GCVE-0-2024-47540)

Vulnerability from cvelistv5 – Published: 2024-12-11 18:54 – Updated: 2025-11-03 20:39

Title

GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer

Summary

GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

GitHub_M

References

4 references

URL	Tags
https://securitylab.github.com/advisories/GHSL-20…	x_refsource_CONFIRM
https://gitlab.freedesktop.org/gstreamer/gstreame…	x_refsource_MISC
https://gstreamer.freedesktop.org/security/sa-202…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
gstreamer	gstreamer	Affected: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47540",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:34:42.237926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:34:59.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:39:37.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size \u003c 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem-\u003eallocator-\u003emem_unmap_full or mem-\u003eallocator-\u003emem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "CWE-457: Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:54:04.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0017.html"
        }
      ],
      "source": {
        "advisory": "GHSA-7r72-m3fh-rrfh",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47540",
    "datePublished": "2024-12-11T18:54:04.383Z",
    "dateReserved": "2024-09-25T21:46:10.930Z",
    "dateUpdated": "2025-11-03T20:39:37.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53705 (GCVE-0-2026-53705)

Vulnerability from cvelistv5 – Published: 2026-06-15 19:10 – Updated: 2026-06-30 12:09

Title

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

Summary

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-53705	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487615	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-06-12 00:00

Credits

Red Hat would like to thank Seung Min Shin for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T03:56:10.671671Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T13:11:13.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-12T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in GStreamer\u0027s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:09:26.907Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53705"
          },
          {
            "name": "RHBZ#2487615",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53705.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-28T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-12T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-good",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-good",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-good",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gstreamer1-plugins-good",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Seung Min Shin for reporting this issue."
        }
      ],
      "datePublic": "2026-06-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GStreamer\u0027s WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T19:10:21.930Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-53705"
        },
        {
          "name": "RHBZ#2487615",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487615"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-28T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-12T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-53705",
    "datePublished": "2026-06-15T19:10:21.930Z",
    "dateReserved": "2026-06-10T15:40:26.501Z",
    "dateUpdated": "2026-06-30T12:09:26.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:2727-1

CVE-2024-47540 (GCVE-0-2024-47540)

CVE-2026-53705 (GCVE-0-2026-53705)

Tags

Sightings

Nomenclature