CVE-2026-19387
Publication date 10 August 2026
Last updated 1 October 2026
Ubuntu priority
Description
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gst-plugins-bad1.0 | 26.04 LTS resolute |
Fixed 1.28.2-1ubuntu1.2
|
| 24.04 LTS noble |
Fixed 1.24.2-1ubuntu4+esm2
|
|
| 22.04 LTS jammy |
Fixed 1.20.3-0ubuntu1.1+esm3
|
|
| 20.04 LTS focal |
Fixed 1.16.3-0ubuntu1.1+esm2
|
|
| 18.04 LTS bionic |
Fixed 1.14.5-0ubuntu1~18.04.1+esm2
|
|
| 16.04 LTS xenial |
Fixed 1.8.3-1ubuntu0.2+esm2
|
|
| 14.04 LTS trusty |
Fixed 1.2.4-1~ubuntu1.1+esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.6 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8855-1
- GStreamer Bad Plugins vulnerability
- 30 September 2026