Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0740

NIXPKGS-2026-0740
published 3 months ago
Permalink CVE-2026-1940
5.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 3 months ago by @LeSuisse Activity log
  • Created suggestion 3 months ago
  • @LeSuisse ignored
    8 packages
    • gst_all_1.gstreamermm
    • gst_all_1.gst-vaapi
    • ocamlPackages_latest.gstreamer
    • ocamlPackages.gstreamer
    • libsForQt5.phonon-backend-gstreamer
    • obs-studio-plugins.obs-gstreamer
    • plasma5Packages.phonon-backend-gstreamer
    • tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
    3 months ago
  • @LeSuisse accepted 3 months ago
  • @LeSuisse published on GitHub 3 months ago
Gstreamer: incomplete fix of cve-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

Affected products

gstreamer
gstreamer1
mingw-gstreamer1

Matching in nixpkgs

Ignored packages (8)

pkgs.ocamlPackages.gstreamer

Bindings for the GStreamer library which provides functions for playning and manipulating multimedia streams

Package maintainers

Advisory: https://gstreamer.freedesktop.org/security/sa-2026-0001.html