CVE-2026-19387: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-19387 is a heap out-of-bounds write vulnerability in the GStreamer gst-plugins-bad adpcmdec element affecting IMA/DVI ADPCM audio decoding. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to trigger writes beyond the allocated output buffer, potentially leading to application crash, denial of service, memory corruption, or arbitrary code execution. The vulnerability was published on August 5–10, 2026, and is tracked under GStreamer Security Advisory GStreamer-SA-2026-0077. It carries a CVSS v3.1 base score of 7.6 (High) (Red Hat CVE, GitHub Advisory).

The root cause (CWE-787: Out-of-bounds Write) lies in the adpcmdec element's sample count validation logic: the check (n_samples - channels) % 8 == 0 does not ensure alignment with the decode loop, which writes 8 * channels samples per iteration. A specially crafted multi-channel IMA ADPCM WAV file can pass this check while causing the decoder to write decoded sample values — partially derived from attacker-controlled compressed audio data — beyond the end of the allocated heap output buffer. Because the adpcmdec element is auto-plugged by GStreamer's decodebin/playbin pipeline, any application that processes untrusted media (media players, thumbnailers, transcoders) can trigger the flaw without explicit user configuration. The fix was applied upstream in gst-plugins-bad 1.28.6 (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in application crash (denial of service), heap memory corruption, limited information disclosure, or potentially arbitrary code execution in the context of the application processing the malicious media file. The confidentiality and integrity impacts are rated Low, while availability impact is High, reflecting the primary risk of crash or DoS with a secondary risk of code execution. Environments most at risk include media players, video/audio thumbnailers, and transcoding services that automatically process untrusted user-supplied WAV files (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as user interaction (opening a crafted file) is required. The EPSS score is approximately 0.24% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher Seonwook Kim (Red Hat CVE, GitHub Advisory).

1. Craft a malicious WAV file: Create a multi-channel IMA/DVI ADPCM WAV file with a per-block sample count that satisfies the flawed validation check (n_samples - channels) % 8 == 0 but causes the decode loop to write beyond the allocated output buffer. The sample count and channel configuration are attacker-controlled fields in the WAV header.
2. Deliver the file to the target: Distribute the crafted WAV file via email attachment, web download, shared network storage, or any channel where the target application will process it (e.g., a media player auto-scanning a directory, a thumbnailer processing uploads).
3. Trigger automatic decoding: When the target application opens or previews the file, GStreamer's decodebin/playbin auto-plugs the adpcmdec element, which begins decoding the malicious audio data without user awareness.
4. Heap out-of-bounds write occurs: The decoder writes 8 * channels samples per iteration beyond the allocated buffer boundary, corrupting adjacent heap memory with values partially derived from the attacker-controlled compressed audio payload.
5. Achieve objective: Depending on heap layout and memory protections, the outcome ranges from application crash (DoS) to potential arbitrary code execution in the context of the media-processing application (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or externally sourced multi-channel WAV files in directories monitored by media players, thumbnailers, or transcoding services.
• Process: Abnormal termination (crash/segfault) of GStreamer-based applications (e.g., totem, rhythmbox, gnome-shell thumbnailer, gst-launch) when processing WAV files; core dump files generated by these processes.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing segmentation fault signals (SIGSEGV) or heap corruption errors from GStreamer processes; application crash reports referencing libgstadpcmdec or adpcmdec.
• Network: Unexpected outbound connections from media-processing applications following WAV file ingestion, which may indicate successful code execution and callback to an attacker-controlled host.

Red Hat has released patched packages addressing this vulnerability across affected RHEL versions: gstreamer1-plugins-bad-free-1.26.7-2.el10_2.7 for RHEL 10 (via RHSA-2026:55433), gstreamer1-plugins-bad-free-1.22.12-7.el9_8.4 for RHEL 9 (via RHSA-2026:55865), and gstreamer1-plugins-bad-free-1.16.1-9.el8_10.2 for RHEL 8 (via RHSA-2026:56521). The upstream fix is available in gst-plugins-bad 1.28.6. As a workaround, Red Hat recommends avoiding playback or processing of untrusted multi-channel IMA ADPCM WAV files and sandboxing applications that handle untrusted media to limit exploitation impact (Red Hat RHSA-55433, Red Hat RHSA-55865, Red Hat Bugzilla).

Red Hat classified this vulnerability as "Important" severity and acknowledged researcher Seonwook Kim for the report. The vulnerability received standard coverage from Linux security aggregators including LinuxSecurity.com, pro-linux.de, and AusCERT, reflecting routine community attention for a media library flaw. No notable independent researcher commentary or significant social media discussion beyond standard vulnerability database syndication was identified (Red Hat CVE).