The vulnerability exists in the gst_wavpack_dec_handle_frame() function of GStreamer's WavPack decoder, where an integer overflow occurs during the calculation of buffer size (4 * block_samples * channels). This results in an insufficient heap allocation, allowing the WavPack library to write decoded audio samples beyond the allocated buffer, causing heap memory corruption. Both 32-bit and 64-bit architectures are affected due to the use of 32-bit integers in the arithmetic before promotion to the allocation size type. The vulnerability is tracked as CVE-2026-53705 with a CVSS 3.1 score of 7.6 (high severity). Red Hat has issued security advisories RHSA-2026:36675 and RHSA-2026:36774 providing updated gstreamer1-plugins-good packages that fix this issue for Red Hat Enterprise Linux 10 and 8 respectively.

Successful exploitation can lead to application crashes (denial of service) or potentially arbitrary code execution on affected systems. The vulnerability requires user interaction (opening a malicious WavPack audio file) and can be exploited remotely. The CVSS score of 7.6 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Red Hat has released official security updates for the gstreamer1-plugins-good package that address this vulnerability. Users and administrators should apply the updates provided in Red Hat Security Advisories RHSA-2026:36675 for Red Hat Enterprise Linux 10 and RHSA-2026:36774 for Red Hat Enterprise Linux 8. No additional mitigation steps are required beyond applying these official patches.