Astra Linux – vulnerability in libsdl2

SDL Simple DirectMedia Layer versions 2.x through 2.0.9 contain a heap-based buffer over-read in FillIMAADPCMblock, caused by an integer overflow in IMAADPCMdecode within audio/SDLwave.c...

Rocky Linux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1774028255)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1774028255 advisory. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a sizet underflow in the IMA-ADPCM and MS-ADPCM audi...

AlmaLinux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

AlmaLinux 9.2 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.2:CLSA-2026:1780592196)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780592196 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

Important: Red Hat Security Advisory: gstreamer1-plugins-bad-free security update

An update for gstreamer1-plugins-bad-free is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2026:66407)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66407 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...

CLSA-2026-1788438390 gstreamer1-plugins-bad-free: Fix of CVE-2026-19387

CVE-2026-19387: fix out-of-bounds write in the IMA ADPCM decoder by correcting the input size check to account for the channel count, and fail negotiation when blockalign is not provided...

CLSA-2026-1788170819 Fix CVE(s): CVE-2021-4156, CVE-2022-33065, CVE-2025-52194

SECURITY UPDATE: multiple signed integer overflows in the AU, MAT4/MAT5, AVR, SDS, AIFF, IRCAM, RF64, PCM and IMA-ADPCM header parsers allow denial of service via a crafted file ELSCVE-171688 - debian/patches/CVE-2022-33065/CVE-2022-33065-1..8,11..13.patch: widen the overflowing dataend, blockwid...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-2119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2119 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for...

Oracle Linux 8 : gstreamer1-plugins-bad-free (ELSA-2026-56521)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-56521 advisory. - Fix IMA ADPCM input size check in adpcmdec CVE-2026-19387 Resolves: RHEL-235503 Tenable has extracted the preceding description block directly from the Oracl...

RockyLinux 8 : gstreamer1-plugins-bad-free (RLSA-2026:56521)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56521 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

RHEL 10 : gstreamer1-plugins-bad-free (RHSA-2026:55433)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55433 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, an underflow of a sizet value in the IMA-ADPCM and MS-ADPCM audio decoders resulted in heap buffer overflow via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtra...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server could crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value = 89. The unvalidated step index is read directly from the network and...

OESA-2026-2712 libsndfile security update

Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fixes: An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with...

OESA-2026-2711 libsndfile security update

Libsndfile is a C library for reading and writing files containing sampled sound such as MS Windows WAV and the Apple/SGI AIFF format through one standard library interface. Security Fixes: An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with...

libsndfile: integer overflow in ima_reader_init()

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application...