{"timestamp":"2026-03-24T13:43:35.376273Z","id":"CVE-2026-1940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"mingw-gstreamer1","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gstreamer1","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OR
          *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
          *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
          *cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* versions up to (excluding) 1.28.1
          *cpe:2.3:a:freedesktop:gst-plugins-good:1.0.0:*:*:*:*:*:*:*

Red Hat, Inc.: https://access.redhat.com/security/cve/CVE-2026-1940 Types: Vendor Advisory

Red Hat, Inc.: https://bugzilla.redhat.com/show_bug.cgi?id=2436932 Types: Issue Tracking, Vendor Advisory

Red Hat, Inc.: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854 Types: Broken Link

Red Hat, Inc.: https://gstreamer.freedesktop.org/security/sa-2026-0001.html Types: Vendor Advisory

Red Hat, Inc.: https://security-tracker.debian.org/tracker/CVE-2026-1940 Types: Third Party Advisory

CWE-125

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

https://access.redhat.com/security/cve/CVE-2026-1940

https://bugzilla.redhat.com/show_bug.cgi?id=2436932

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854

https://gstreamer.freedesktop.org/security/sa-2026-0001.html

https://security-tracker.debian.org/tracker/CVE-2026-1940