This vulnerability involves a heap out-of-bounds write in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio streams. The root cause is insufficient validation of the per-block sample count for multi-channel audio streams, which allows a specially crafted multi-channel WAV file to cause writes beyond the allocated output buffer. This memory corruption can lead to application instability, denial of service, or potentially arbitrary code execution. The flaw affects Red Hat Enterprise Linux 10 and related products that use this GStreamer plugin. Red Hat has issued a security advisory and released updated gstreamer1-plugins-bad-free packages to fix the issue.

The vulnerability can lead to application crashes and denial of service due to heap corruption. More severe impacts include memory corruption that may allow an attacker to execute arbitrary code when untrusted media files are processed. The CVSS v3.1 base score is 7.6 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and high availability impact. Confidentiality and integrity impacts are low.

Red Hat has released an official security update for gstreamer1-plugins-bad-free that fixes this vulnerability. Users should apply the update available for Red Hat Enterprise Linux 10 and related variants as described in Red Hat advisory RHSA-2026:55433. Until the update is applied, users should avoid playing or processing untrusted multi-channel IMA ADPCM WAV files. Sandboxing applications that handle untrusted media is also recommended to limit potential exploitation impact.