Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1940: gst-plugins-good could let attackers crash the system

CVE-2026-1940 · published 7 months ago

Summary

Certain versions of the gst-plugins-good package used in Debian, Red Hat and other Linux systems can be triggered to stop working, potentially bringing down applications that rely on it. This creates a denial‑of‑service risk for any service using the GStreamer multimedia framework. Install the latest patched version of the package from your Linux distribution's updates to eliminate the risk.

What to do

Update debian gst-plugins-good1.0 to version 1.28.1-1.
Update debian gst-plugins-good1.0 to version 1.22.0-5+deb12u3.aikido.2.
Update debian rootio-gst-plugins-good1.0 to version 1.22.0-5+deb12u3.aikido.2.
Update debian gst-plugins-good1.0 to version 1.26.2-1+deb13u2.
Update debian gst-plugins-good1.0 to version 1.22.0-5+deb12u4.
Update gst-plugins-good1.0 to version 1.22.0-5+deb12u3.aikido.2.
Update rootio-gst-plugins-good1.0 to version 1.22.0-5+deb12u3.aikido.2.
Update gstreamer gstreamer to version 1.28.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	gst-plugins-good1.0	All versions
Debian:12	debian	gst-plugins-good1.0	< 1.22.0-5+deb12u4 Fix: upgrade to 1.22.0-5+deb12u4
Debian:13	debian	gst-plugins-good1.0	< 1.26.2-1+deb13u2 Fix: upgrade to 1.26.2-1+deb13u2
Debian:14	debian	gst-plugins-good1.0	< 1.28.1-1 Fix: upgrade to 1.28.1-1
–	gstreamer	gstreamer	< 1.28.1 `cpe:2.3:a:gstreamer:gstreamer::::::::`
–	debian	debian_linux	11.0 12.0 `cpe:2.3:o:debian:debian_linux:11.0:::::::*`
–	redhat	enterprise_linux	7.0 8.0 9.0 10.0 `cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*`
–	freedesktop	gst-plugins-good	1.0.0 `cpe:2.3:a:freedesktop:gst-plugins-good:1.0.0:::::::*`
Root:Debian:12	debian	gst-plugins-good1.0	< 1.22.0-5+deb12u3.aikido.2 Fix: upgrade to 1.22.0-5+deb12u3.aikido.2
Root:Debian:12	debian	rootio-gst-plugins-good1.0	< 1.22.0-5+deb12u3.aikido.2 Fix: upgrade to 1.22.0-5+deb12u3.aikido.2
Ubuntu:Pro:14.04:LTS	canonical	gst-plugins-bad1.0	All versions
Root:Debian:12	–	gst-plugins-good1.0	< 1.22.0-5+deb12u3.aikido.2 Fix: upgrade to 1.22.0-5+deb12u3.aikido.2
Root:Debian:12	–	rootio-gst-plugins-good1.0	< 1.22.0-5+deb12u3.aikido.2 Fix: upgrade to 1.22.0-5+deb12u3.aikido.2

Original advisory text

CVE-2026-1940 in gst-plugins-good1.0 - Patched by Root

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

References

https://security-tracker.debian.org/tracker/CVE-2026-1940 Vendor Advisory
https://gstreamer.freedesktop.org/security/sa-2026-0001.html URL
https://access.redhat.com/security/cve/CVE-2026-1940 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2436932 Third Party Advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 Third Party Advisory
https://access.redhat.com/downloads/content/package-browser/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1940.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1940 Vendor Advisory
https://ubuntu.com/security/CVE-2026-1940 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-1940 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published23 Mar 2026

Updated4 Nov 2026

First seen22 Mar 2026

Sources

DEBIAN-CVE-2026-1940 · OSV

ROOT-OS-DEBIAN-12-CVE-2026-1940 · OSV

CVE-2026-1940 · NVD

UBUNTU-CVE-2026-1940 · OSV

CVE-2026-1940 · OSV

Track software like this

Free during beta