CVE-2026-1940: 
NixOS vulnerability analysis and mitigation

CVE-2026-1940 is an out-of-bounds read vulnerability in GStreamer's gst_wavparse_adtl_chunk() function, representing an incomplete fix for the previously patched CVE-2024-47778. The flaw exists in the gst-plugins-good component and affects GStreamer versions before 1.28.1, as well as downstream distributions including Red Hat Enterprise Linux 7.0–10.0, Debian Linux 11.0 and 12.0, Amazon Linux 2, and IBM App Connect Enterprise Certified Container. It was published on March 23, 2026, with the Red Hat Bugzilla entry filed on February 4, 2026. The CVSS v3.1 base score is 7.5 (High) per NVD scoring, though Red Hat's own assessment assigns a score of 5.1 (Medium) (Red Hat CVE, Red Hat Bugzilla, GStreamer Advisory).

The root cause is an out-of-bounds read (CWE-125) in the WAV file parser within gst-plugins-good. The prior patch for CVE-2024-47778 added a bounds check lsize + 8 > size, but failed to account for the GST_ROUND_UP_2(lsize) macro used in the actual byte offset calculation. When lsize is an odd number, the macro rounds it up by one, causing the parser to advance one byte beyond the validated boundary — resulting in an OOB read. An attacker can trigger this by supplying a specially crafted WAV file with an odd-valued lsize field in the adtl chunk, which is processed without user interaction if the media is opened by an application using GStreamer (Red Hat Bugzilla, GStreamer Advisory, Debian Tracker).

Successful exploitation results in an out-of-bounds memory read, which can cause application crashes (denial of service) or potentially expose sensitive memory contents. The primary impact is availability (crash of the media-processing application), with limited confidentiality risk from memory disclosure. Integrity is not directly affected. The vulnerability is scoped to the affected process and does not inherently enable lateral movement, but memory disclosure could assist in bypassing ASLR in chained exploit scenarios (Red Hat CVE, GStreamer Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-1940. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 692231, 362057) and Nessus (IDs: 301748, 304611, 311210), indicating scanner coverage for affected systems (Red Hat CVE, GStreamer Advisory).

1. Craft a malicious WAV file: Create a WAV file with an adtl (Associated Data List) chunk where the lsize field is set to an odd number. This causes GST_ROUND_UP_2(lsize) to advance the parser one byte beyond the validated boundary.
2. Deliver the file to the target: Distribute the crafted WAV file via email attachment, web download, or a streaming media server accessible to the target application using GStreamer.
3. Trigger parsing: Cause the target application (e.g., a media player, transcoder, or any GStreamer-based pipeline) to open or process the malicious WAV file, invoking gst_wavparse_adtl_chunk().
4. Achieve OOB read: The parser reads one byte beyond the validated buffer boundary. Depending on memory layout, this may crash the application (DoS) or leak adjacent memory contents.
5. Leverage memory disclosure (optional): If memory contents are surfaced to the attacker (e.g., via error messages or network responses), the leaked data could be used to defeat ASLR and facilitate further exploitation (Red Hat Bugzilla, GStreamer Advisory).

• File System: Presence of unexpected or externally sourced WAV files with unusual adtl chunk structures in media directories or temporary folders.
• Logs: Application crash logs or core dumps from GStreamer-based processes (e.g., gst-launch, media players, transcoding services) referencing gst_wavparse_adtl_chunk in stack traces.
• Process: Unexpected termination (segmentation fault) of GStreamer-based media processing applications, particularly when handling WAV files from untrusted sources.
• Network: Unusual inbound delivery of WAV files from external or unexpected sources to systems running GStreamer-based applications.

The fix is available in GStreamer gst-plugins-good version 1.28.1 and later. Debian users should upgrade to gst-plugins-good1.0 version 1.28.1-1 or later (available in forky/sid); older stable releases (bullseye, bookworm, trixie) are classified as minor issues and may receive backported fixes. Red Hat Enterprise Linux users should apply available errata updates. IBM App Connect Enterprise Certified Container users should apply the UBI updates referenced in IBM's security bulletin. As a workaround where patching is not immediately possible, restrict processing of untrusted WAV files through GStreamer-based applications (GStreamer Advisory, Debian Tracker, IBM Advisory).

The vulnerability was reported via the OSS-Security mailing list and tracked across multiple vulnerability databases. Red Hat classified it as medium severity, while NVD assigned a higher score of 7.5. IBM issued a security bulletin for affected App Connect Enterprise Certified Container products. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and scanner plugin releases.