CVE-2026-53705 is an integer overflow vulnerability in the gst_wavpack_dec_handle_frame() function of GStreamer's WavPack audio decoder within the gst-plugins-good package on Red Hat Enterprise Linux 10. The vulnerability arises from a 32-bit integer overflow in the buffer size calculation (4 * block_samples * channels), resulting in a smaller than intended heap allocation. Subsequently, the WavPack library writes decoded audio samples beyond the allocated buffer, causing heap memory corruption. This affects both 32-bit and 64-bit systems. Exploitation requires a user to open a maliciously crafted WavPack audio file, potentially leading to application crashes or arbitrary code execution. Red Hat has issued an important security update fixing this vulnerability in gstreamer1-plugins-good.

The vulnerability allows remote attackers to cause heap memory corruption by processing a crafted WavPack audio file, which can lead to application crashes (denial of service) or potentially arbitrary code execution. The CVSS v3.1 score is 7.6 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Red Hat has released official security updates for the gstreamer1-plugins-good package that fix this vulnerability. Users of Red Hat Enterprise Linux 10 should apply the updates provided in advisory RHSA-2026:36675 as soon as possible. The vendor advisory and article https://access.redhat.com/articles/11258 provide detailed instructions for applying the patch. No additional mitigations are required beyond applying the official fix.