Security update for gstreamer-plugins-good

CVE-2026-53705 is a vulnerability in GStreamer's WavPack audio decoder (gst-plugins-good) where an integer overflow in the buffer size calculation (4 * block_samples * channels) in the gst_wavpack_dec_handle_frame() function causes a heap buffer overflow. The arithmetic is done using 32-bit integers before being promoted to the allocation size type, affecting both 32-bit and 64-bit architectures. This leads to heap memory corruption when decoded audio samples are written beyond the allocated buffer. A remote attacker can exploit this by providing a malicious WavPack file to cause denial of service or potentially execute arbitrary code. Red Hat has issued security advisories and patches for affected Red Hat Enterprise Linux 8 and 10 versions to fix this vulnerability.

The vulnerability can cause heap memory corruption resulting in application crashes (denial of service) or potentially arbitrary code execution if exploited. It affects both 32-bit and 64-bit systems running vulnerable versions of gst-plugins-good. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality and integrity impact, and high availability impact.

Red Hat has released official security updates for the gstreamer1-plugins-good package that address this vulnerability. Users should apply the updates provided in Red Hat Enterprise Linux 8 and 10 as detailed in the Red Hat advisories RHSA-2026:36675 and RHSA-2026:36774. Refer to https://access.redhat.com/articles/11258 for update instructions. Applying these updates mitigates the vulnerability. No additional mitigation steps are required beyond applying the official patches.