CVE-2026-19387 is a security flaw found in the GStreamer gst-plugins-bad library that affects the adpcmdec plugin used for decoding ADPCM audio files. This particular security flaw is described as a heap out-of-bounds write error and falls under CWE-787 (Out-of-bounds Write) category. It concerns improper validation of per-block sample count in multi-channel IMA/DVI ADPCM streams.
What Is CVE-2026-19387?
CVE-2026-19387 is a heap out-of-bounds write vulnerability in the GStreamer ADPCM decoder. A specially crafted audio input can cause the decoder to write past the boundary of the allocated heap buffer. The vulnerability specifically affects the handling of IMA/DVI ADPCM streams with multiple channe ls where the decoder fails to validate the number of samples per block.
The specific vulnerability concerns IMA/DVI ADPCM streams with multi-channel, where the decoder fails to check the number of samples per block.
What Is GStreamer?
GStreamer is a free and open-source multimedia framework for handling audio and video streams. It provides modular components that can be used for media playback, encoding, decoding, transcoding, and streaming. The affected component in this CVE is the adpcmdec decoder plugin within the gst-plugins-bad collection.
What Is the ADPCM Decoder?
ADPCM (Adaptive Differential Pulse Code Modulation) is an audio encoding algorithm that compresses audio by storing the differences between adjacent samples rather than full sample values. The adpcmdec plugin decodes IMA/DVI ADPCM streams and writes the computed audio samples to an output buffer. CVE-2026-19387 occurs when multi-channel input carries an inconsistent sample count that the decoder does not validate.
Understanding Heap Out-of-Bounds Write (CWE-787)
A heap out-of-bounds write (CWE-787) occurs when a program writes data beyond the boundaries of a heap-allocated memory buffer. For example, an application allocates memory for a specific number of audio samples but ends up writing more samples than the buffer can hold, overwriting adjacent memory regions.
Heap out-of-bounds writes are considered serious memory safety flaws because they can result in application crashes, memory corruption, Denial of Service, or — under certain memory layout conditions — arbitrary code execution.
How Does CVE-2026-19387 Work?
The vulnerability is caused by insufficient validation of the per-block sample count in multi-channel IMA/DVI ADPCM streams. A maliciously crafted audio file can include a sample count value that is inconsistent with the allocated output buffer size. When the decoder processes such input without checking the expected output size, it computes an incorrect buffer requirement and writes beyond the allocated heap memory.
The resulting condition is a heap out-of-bounds write.
A simplified flow is:
Crafted ADPCM input → adpcmdec processes sample information → insufficient validation → excessive output writes → heap memory corruption
Root Cause of CVE-2026-19387
The root cause is insufficient validation of the per-block sample count before the decoder writes audio data to the output buffer. The decoder should verify that the amount of output data it intends to write does not exceed the allocated buffer space. When the input contains values outside expected limits, the missing check allows an out-of-bounds write to occur.
This is why the vulnerability is classified under CWE-787.
Affected GStreamer Components and Versions
The vulnerable component is the adpcmdec plugin within the gst-plugins-bad collection. On Red Hat platforms, the affected package is gstreamer1-plugins-bad-free. CVE-2026-19387 is confirmed to affect Red Hat Enterprise Linux 7, 8, 9, and 10. GStreamer is also distributed as part of many other Linux distributions including Ubuntu, Debian, Fedora, and openSUSE, which may release their own security updates. Users should install the latest security updates provided by their Linux distribution vendor.
CVSS Score and Severity of CVE-2026-19387
CVE-2026-19387 has not yet received a final CVSS v3.x base score assignment at the time of this publication. Based on the vulnerability characteristics — a heap out-of-bounds write triggered by processing a specially crafted audio file — the exploitability typically depends on the user opening a malicious audio file or a network service parsing untrusted audio input. Users should check their Linux distribution’s security advisory (such as the Red Hat Security Advisory) for the official severity rating assigned to their platform.
Attack Vector and Exploitation Scenario
CVE-2026-19387 can be exploited when the GStreamer adpcmdec plugin processes a specially crafted audio file. The attack can occur in two contexts:
Local File-Based Attack: An attacker crafts a malicious ADPCM audio file and persuades a user to open it using a GStreamer-based media player, editing tool, or application. When the adpcmdec plugin processes the file, the insufficient sample count validation triggers the heap out-of-bounds write.
Network Streaming Attack: If GStreamer is deployed in a streaming server or content pipeline that processes untrusted audio data from the network, an attacker could send a crafted audio stream to trigger the vulnerability without requiring user interaction.
Impact of CVE-2026-19387
- Application Crash and Denial of Service: Writing beyond the allocated heap buffer can corrupt adjacent memory structures, causing the GStreamer process or the application using it to crash unexpectedly.
- Memory Corruption: Heap memory corruption caused by the out-of-bounds write may affect the integrity of data structures in adjacent memory, leading to unpredictable application behaviour.
- Potential Code Execution: Under specific memory layout conditions, an attacker who controls the content written out-of-bounds may be able to overwrite function pointers or other control data, potentially leading to arbitrary code execution within the context of the application using GStreamer.
- Impact on Dependent Services: Applications that use GStreamer for audio processing — including media players, video conferencing tools, and streaming servers — are affected wherever the vulnerable plugin is loaded and processes untrusted input.
Mitigation and Security Recommendations
- Apply Distribution Security Updates: Install the security update for gstreamer1-plugins-bad-free (or your distribution’s equivalent package) as soon as it becomes available. On RHEL systems, apply the official Red Hat Security Advisory (RHSA). On Debian/Ubuntu systems, use apt update && apt upgrade gstreamer1.0-plugins-bad.
- Avoid Processing Untrusted Audio Files: Where possible, restrict GStreamer-based applications from processing audio files or streams received from untrusted or unverified sources until the patch has been applied.
- Disable Unused Codecs: If IMA/DVI ADPCM decoding is not required in your deployment, unload or disable the adpcmdec plugin as a temporary workaround until the patched version can be applied.
- Enable Application Sandboxing: Run GStreamer-based media processing services inside containers or sandboxes with restricted privileges to limit the potential impact of memory corruption exploitation.
- Conduct Input Validation Audits: Integrate memory safety analysis tools such as AddressSanitizer (ASan) and fuzz testing into GStreamer plugin development workflows to detect out-of-bounds write conditions early in the development lifecycle.
Frequently Asked Questions (FAQs)
Conclusion
CVE-2026-19387 highlights the importance of input validation in multimedia codec implementations. A missing boundary check in the per-block sample count validation of the GStreamer ADPCM decoder can lead to heap memory corruption when processing a specially crafted audio file. Organisations and users running GStreamer on RHEL or other Linux distributions should apply the relevant security update promptly. Restricting untrusted audio input and sandboxing media processing services provides additional protection while patches are being deployed.
