A heap out-of-bounds write vulnerability exists in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio streams. The vulnerability is due to insufficient validation of the per-block sample count for multi-channel streams, which allows a specially crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crashes, denial of service, memory corruption, or potentially arbitrary code execution. The issue is present in Red Hat Enterprise Linux 10 where applications process untrusted media such as media players or transcoding services. The vulnerability has a CVSS v3.1 score of 7.6 (high severity) with network attack vector, low attack complexity, no privileges required, and user interaction required. Red Hat's advisory recommends avoiding processing untrusted multi-channel IMA ADPCM WAV files and sandboxing applications handling such media. No official patch or fix has been confirmed at this time.

The vulnerability can cause application crashes and denial of service due to heap out-of-bounds writes. Memory corruption may occur, which in some cases could allow an attacker to execute arbitrary code when processing crafted untrusted media files. This impacts the confidentiality, integrity, and availability of affected applications that decode IMA/DVI ADPCM audio streams using the vulnerable GStreamer element.

Red Hat advises users to avoid playing or processing untrusted multi-channel IMA ADPCM WAV files to mitigate this issue. Additionally, sandboxing applications that handle untrusted media can limit the potential impact of exploitation. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-19387 for updates on fixes or official remediation guidance.