A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2727-1 advisory.

    This update for gstreamer-plugins-good fixes the following issues

    - CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
    - CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4e82a0e6-6801-42c6-8fb6-91b6b275a9e1 advisory.

    The GStreamer project reports:
    Multiple security issues were identified and fixed in the GStreamer framework.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially     crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in     gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes     decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects     both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to     the allocation size type. A remote attacker could use this flaw to crash an application or potentially     execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325035	SUSE SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2026:2727-1)	Nessus	SuSE Local Security Checks	high
323684	FreeBSD : gstreamer1 -- multiple vulnerabilities (4e82a0e6-6801-42c6-8fb6-91b6b275a9e1)	Nessus	FreeBSD Local Security Checks	high
321141	Linux Distros Unpatched Vulnerability : CVE-2026-53705	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53705

high

Tenable Plugins

high

high

high