# CVE-2026-53705: gstreamer1.0-gtk3: A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good

CVE-2026-53705 is fixed in 13 products on 1 platform, first by gstreamer1.0-gtk3 1.28.2-2ubuntu0.1, released June 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-53705
- Priority: High
- CVSS: 7.6 (Medium)
- EPSS: 0.0038
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 12, 2026

## Description

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gst-plugins-good1.0 Debian 12.15 (bookworm) | 1.22.0-5+deb12u4 | [DEBIAN-CVE-2026-53705](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53705.md) | Jun 24, 2026 |
| Linux | gst-plugins-good1.0 Debian 14 | 1.28.4-1 | [DEBIAN-CVE-2026-53705](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53705.md) | Jun 24, 2026 |
| Linux | gstreamer-plugins-good opensuse-leap 16.0 | 1.26.7-160000.2.1 | [OPENSUSE-SU-2026:21240-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21240-1.md) | Jul 6, 2026 |
| Linux | gstreamer-plugins-good sles 15.6 | 1.24.0-150600.3.10.1 | [SUSE-SU-2026:2843-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2843-1.md) | Jul 10, 2026 |
| Linux | gstreamer-plugins-good sles 15.7 | 1.24.0-150600.3.10.1 | [SUSE-SU-2026:2843-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2843-1.md) | Jul 10, 2026 |
| Linux | gstreamer1-plugins-good RHEL 10 | 1.24.11-1.el10_0.3 | [RHSA-2026:47032](https://patchblox.com/security/data/fix/linux/rhsa-2026-47032.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good RHEL 8 | 0:1.16.1-7.el8_10 | [RHSA-2026:36774](https://patchblox.com/security/data/fix/linux/rhsa-2026-36774.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good RHEL 9 | 0:1.22.12-7.el9_8.1 | [RHSA-2026:37129](https://patchblox.com/security/data/fix/linux/rhsa-2026-37129.md) | Jul 10, 2026 |
| Linux | gstreamer1-plugins-good almalinux 10 | 1.26.7-2.el10_2.1 | [ALSA-2026:36675](https://patchblox.com/security/data/fix/linux/alsa-2026-36675.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good almalinux 8 | 1.16.1-7.el8_10 | [ALSA-2026:36774](https://patchblox.com/security/data/fix/linux/alsa-2026-36774.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good almalinux 9 | 1.22.12-7.el9_8.1 | [ALSA-2026:37129](https://patchblox.com/security/data/fix/linux/alsa-2026-37129.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good amzn 2023 | 1.24.10-1.amzn2023.0.7 | [ALAS2023-2026-1926](https://patchblox.com/security/data/fix/linux/alas2023-2026-1926.md) | Jul 6, 2026 |
| Linux | gstreamer1-plugins-good ol 10 | 0:1.26.7-2.el10_2.1 | [ELSA-2026-36675](https://patchblox.com/security/data/fix/linux/elsa-2026-36675.md) | Jul 16, 2026 |
| Linux | gstreamer1-plugins-good ol 8 | 0:1.16.1-7.el8_10 | [ELSA-2026-36774](https://patchblox.com/security/data/fix/linux/elsa-2026-36774.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good ol 9 | 0:1.22.12-7.el9_8.1 | [ELSA-2026-37129](https://patchblox.com/security/data/fix/linux/elsa-2026-37129.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good rocky 10 | 0:1.26.7-2.el10_2.1 | [RLSA-2026:36675](https://patchblox.com/security/data/fix/linux/rlsa-2026-36675.md) | Jul 10, 2026 |
| Linux | gstreamer1-plugins-good rocky 8 | 0:1.16.1-7.el8_10 | [RLSA-2026:36774](https://patchblox.com/security/data/fix/linux/rlsa-2026-36774.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good rocky 9 | 0:1.22.12-7.el9_8.1 | [RLSA-2026:37129](https://patchblox.com/security/data/fix/linux/rlsa-2026-37129.md) | Jul 10, 2026 |
| Linux | gstreamer1-plugins-good-debuginfo amzn 2023 | 1.24.10-1.amzn2023.0.7 | [ALAS2023-2026-1926](https://patchblox.com/security/data/fix/linux/alas2023-2026-1926.md) | Jul 6, 2026 |
| Linux | gstreamer1-plugins-good-debugsource amzn 2023 | 1.24.10-1.amzn2023.0.7 | [ALAS2023-2026-1926](https://patchblox.com/security/data/fix/linux/alas2023-2026-1926.md) | Jul 6, 2026 |
| Linux | gstreamer1-plugins-good-gtk RHEL 8 | 0:1.16.1-7.el8_10 | [RHSA-2026:36774](https://patchblox.com/security/data/fix/linux/rhsa-2026-36774.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good-gtk RHEL 9 | 0:1.22.12-7.el9_8.1 | [RHSA-2026:37129](https://patchblox.com/security/data/fix/linux/rhsa-2026-37129.md) | Jul 10, 2026 |
| Linux | gstreamer1-plugins-good-gtk almalinux 10 | 1.26.7-2.el10_2.1 | [ALSA-2026:36675](https://patchblox.com/security/data/fix/linux/alsa-2026-36675.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good-gtk almalinux 8 | 1.16.1-7.el8_10 | [ALSA-2026:36774](https://patchblox.com/security/data/fix/linux/alsa-2026-36774.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good-gtk almalinux 9 | 1.22.12-7.el9_8.1 | [ALSA-2026:37129](https://patchblox.com/security/data/fix/linux/alsa-2026-37129.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good-gtk amzn 2023 | 1.24.10-1.amzn2023.0.7 | [ALAS2023-2026-1926](https://patchblox.com/security/data/fix/linux/alas2023-2026-1926.md) | Jul 6, 2026 |
| Linux | gstreamer1-plugins-good-gtk ol 10 | 0:1.26.7-2.el10_2.1 | [ELSA-2026-36675](https://patchblox.com/security/data/fix/linux/elsa-2026-36675.md) | Jul 16, 2026 |
| Linux | gstreamer1-plugins-good-gtk ol 8 | 0:1.16.1-7.el8_10 | [ELSA-2026-36774](https://patchblox.com/security/data/fix/linux/elsa-2026-36774.md) | Jul 8, 2026 |
| Linux | gstreamer1-plugins-good-gtk ol 9 | 0:1.22.12-7.el9_8.1 | [ELSA-2026-37129](https://patchblox.com/security/data/fix/linux/elsa-2026-37129.md) | Jul 9, 2026 |
| Linux | gstreamer1-plugins-good-gtk-debuginfo amzn 2023 | 1.24.10-1.amzn2023.0.7 | [ALAS2023-2026-1926](https://patchblox.com/security/data/fix/linux/alas2023-2026-1926.md) | Jul 6, 2026 |
| Linux | gstreamer1.0-gtk3 Ubuntu 22.04.1 LTS (jammy) | 1.20.3-0ubuntu1.7 | [gstreamer1.0-gtk3 1.20.3-0ubuntu1.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gstreamer1.0-gtk3-1.20.3-0ubuntu1.7.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-gtk3 Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [gstreamer1.0-gtk3 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gstreamer1.0-gtk3-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-gtk3 Ubuntu 26.04.1 LTS (resolute) | 1.28.2-2ubuntu0.1 | [gstreamer1.0-gtk3 1.28.2-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gstreamer1.0-gtk3-1.28.2-2ubuntu0.1.md) | Jun 15, 2026 |
| Linux | gstreamer1.0-plugins-good Ubuntu 22.04.1 LTS (jammy) | 1.20.3-0ubuntu1.7 | [gstreamer1.0-plugins-good 1.20.3-0ubuntu1.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gstreamer1.0-plugins-good-1.20.3-0ubuntu1.7.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-plugins-good Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [gstreamer1.0-plugins-good 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gstreamer1.0-plugins-good-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-plugins-good Ubuntu 26.04.1 LTS (resolute) | 1.28.2-2ubuntu0.1 | [gstreamer1.0-plugins-good 1.28.2-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gstreamer1.0-plugins-good-1.28.2-2ubuntu0.1.md) | Jun 15, 2026 |
| Linux | gstreamer1.0-pulseaudio Ubuntu 22.04.1 LTS (jammy) | 1.20.3-0ubuntu1.7 | [gstreamer1.0-pulseaudio 1.20.3-0ubuntu1.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gstreamer1.0-pulseaudio-1.20.3-0ubuntu1.7.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-pulseaudio Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [gstreamer1.0-pulseaudio 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gstreamer1.0-pulseaudio-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-pulseaudio Ubuntu 26.04.1 LTS (resolute) | 1.28.2-2ubuntu0.1 | [gstreamer1.0-pulseaudio 1.28.2-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gstreamer1.0-pulseaudio-1.28.2-2ubuntu0.1.md) | Jun 15, 2026 |
| Linux | gstreamer1.0-qt5 Ubuntu 22.04.1 LTS (jammy) | 1.20.3-0ubuntu1.7 | [gstreamer1.0-qt5 1.20.3-0ubuntu1.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gstreamer1.0-qt5-1.20.3-0ubuntu1.7.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-qt5 Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [gstreamer1.0-qt5 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gstreamer1.0-qt5-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-qt5 Ubuntu 26.04.1 LTS (resolute) | 1.28.2-2ubuntu0.1 | [gstreamer1.0-qt5 1.28.2-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gstreamer1.0-qt5-1.28.2-2ubuntu0.1.md) | Jun 15, 2026 |
| Linux | gstreamer1.0-qt6 Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [gstreamer1.0-qt6 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gstreamer1.0-qt6-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |
| Linux | gstreamer1.0-qt6 Ubuntu 26.04.1 LTS (resolute) | 1.28.2-2ubuntu0.1 | [gstreamer1.0-qt6 1.28.2-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-gstreamer1.0-qt6-1.28.2-2ubuntu0.1.md) | Jun 15, 2026 |
| Linux | libgstreamer-plugins-good1.0-0 Ubuntu 22.04.1 LTS (jammy) | 1.20.3-0ubuntu1.7 | [libgstreamer-plugins-good1.0-0 1.20.3-0ubuntu1.7](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libgstreamer-plugins-good1.0-0-1.20.3-0ubuntu1.7.md) | Jun 16, 2026 |
| Linux | libgstreamer-plugins-good1.0-0 Ubuntu 24.04.5 LTS (noble) | 1.24.2-1ubuntu1.5 | [libgstreamer-plugins-good1.0-0 1.24.2-1ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgstreamer-plugins-good1.0-0-1.24.2-1ubuntu1.5.md) | Jun 16, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.