CVE-2026-1940

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > size, but it does not account for the GST_ROUND_UP_2(lsize) used in the actual offset calculation. When lsize is an odd number, the parser advances more bytes than validated, causing OOB read.

• CWE-125

• https://access.redhat.com/security/cve/CVE-2026-1940Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2436932Issue Tracking, Vendor Advisory
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854Broken Link
• https://gstreamer.freedesktop.org/security/sa-2026-0001.htmlVendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-1940Third Party Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19383A security vulnerability has been detected in saithink/saigr…4.7
• CVE-2026-19384A weakness has been identified in SourceCodester Simple Doct…7.3
• CVE-2026-19387A heap out-of-bounds write vulnerability was found in the GS…7.6
• CVE-2026-19389Multiple integer overflow and underflow vulnerabilities were…7.1
• CVE-2026-1939The Percent to Infograph plugin for WordPress is vulnerable …6.4
• CVE-2026-19391A flaw was found in insights-core where the password redacti…6.5
• CVE-2026-19404A flaw was found in 389 Directory Server. The CleanAllRUV an…6.5
• CVE-2026-1941The WP Event Aggregator plugin for WordPress is vulnerable t…6.4
• CVE-2026-19411A NULL pointer vulnerability has been found in the the shim …3.9
• CVE-2026-19418The referrer enforcement introduced with TYPO3-CORE-SA-2020-…7.3
• CVE-2026-1942The Blog2Social: Social Media Auto Post & Scheduler plugin f…6.5
• CVE-2026-19424Chiline Cloud developed by Inventec Appliances has a Insecur…7.5