CVE-2026-19387

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-bad (affected versions not specified)

Description A heap out-of-bounds write occurs in the adpcmdec element when decoding IMA/DVI ADPCM audio. This is caused by insufficient validation of the per-block sample count for multi-channel streams, allowing a specially crafted WAV file to trigger writes beyond the allocated output buffer. This may result in memory corruption, application crashes, denial of service, or arbitrary code execution during the processing of untrusted media.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.