Security Advisory 2026-0021 (CVE-2026-39044)

Details

An integer overflow in the WAV parser (wavparse) when handling malformed WAV files with cue chunks. The vulnerability occurs during buffer size validation when calculating the expected size for cue entries (ncues * 24), where insufficient bounds checking allows integer overflow during the multiplication operation.

Impact

A malicious third party could trigger a crash in the application, resulting in denial of service, when processing malicious WAV media files. Memory exhaustion may also occur during cue chunk parsing.

Solution

The gst-plugins-good 1.28.2 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• CVE-2026-39044

GStreamer 1.28.2 release

• Release Notes
• GStreamer Plugins Good 1.28.2

Patches

• Patch