Description

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-10T03:16:40.223Z",
  "pubdate": "2026-08-10T03:16:40.223Z",
  "executiveSummary": "A heap out-of-bounds write vulnerability has been identified in the GStreamer gst-plugins-bad package, specifically within the adpcmdec element during the decoding of IMA/DVI ADPCM audio streams. The root cause stems from insufficient validation of the per-block sample count when processing multi-channel audio streams. An attacker can exploit this flaw by crafting a malicious WAV file containing manipulated block headers. When an application utilizing GStreamer processes this untrusted media, the decoding logic miscalculates buffer size requirements, resulting in memory writes extending past the boundaries of the allocated heap output buffer. The impact of this vulnerability ranges from application crashes and denial of service conditions to memory corruption and potential arbitrary code execution within the context of the running process. Successful exploitation requires the targeted application to parse an attacker-supplied media file, meaning the attack vector relies on local file processing or remote media ingestion where untrusted input is fed into the vulnerable gst-plugins-bad decoding pipeline. No special privileges or authentication are inherently required beyond the ability to supply a malicious multimedia file to the vulnerable software.",
  "technicalDetails": "The vulnerability resides in the adpcmdec element provided by the GStreamer gst-plugins-bad plugin, which is responsible for decoding IMA and DVI Adaptive Differential Pulse Code Modulation audio formats. Specifically, the flaw occurs during the parsing and decoding of audio blocks derived from container formats such as WAV files. The core technical mechanism involves the handling of multi-channel audio streams where individual audio blocks specify a per-block sample count. The vulnerability manifests due to inadequate bounds checking and validation logic applied to this sample count parameter relative to the allocated heap output buffer size.\nDuring normal operation, the adpcmdec element allocates a heap output buffer based on expected header dimensions and sample parameters. However, when processing a crafted WAV file, an attacker can manipulate the per-block sample count metadata for multi-channel streams. Because the component fails to properly validate this value against the actual physical boundaries of the allocated heap buffer, subsequent decoding loops write decoded PCM audio samples past the designated end of the buffer. This triggers a heap out-of-bounds write condition.\nThe attack flow proceeds as follows: First, the threat actor crafts a malicious WAV file containing altered ADPCM block headers with inconsistent multi-channel sample counts. Second, the victim application invokes the GStreamer framework to load and decode the media stream, routing the data through the gst-plugins-bad adpcmdec element. Third, the adpcmdec element processes the stream, trusting the malformed per-block sample count without sufficient sanitization. Fourth, during the conversion of compressed ADPCM blocks into raw PCM output, the decoding routine writes data beyond the limits of the heap buffer, corrupting adjacent heap metadata or heap chunks. Finally, this memory corruption results in an immediate segmentation fault and application termination, or under more sophisticated exploitation conditions, enables the manipulation of dynamic memory structures to achieve arbitrary code execution."
}