CVE-2026-53705: Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

Synopsis

A heap buffer overflow affects GStreamer's WavPack audio decoder in gst-plugins-good. The flaw is reachable over the network but requires a user to open a malicious WavPack file; no authentication is needed. Successful exploitation crashes the affected application or gives the attacker arbitrary code execution on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious WavPack file over the network, so the affected service or user endpoint must be reachable from an external origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated party can supply the crafted file.

• Victim interactionRequired

  A user must be convinced to open the malicious WavPack audio file, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploit conditions are reliable and largely condition-free; the integer overflow is deterministic and does not depend on race conditions or specific memory layout.

Blast Radius

• A successful exploit crashes the application processing the WavPack file, taking down any dependent service or pipeline stage with it.
• Heap memory corruption beyond the allocation boundary gives the attacker a write primitive that can overwrite adjacent heap metadata or data structures.
• On a successful code-execution path, the attacker gains the full privileges of the process running the GStreamer decoder, which may include access to session data, credentials, or other in-memory secrets.
• Both 32-bit and 64-bit container images are affected because the overflow occurs in 32-bit arithmetic before the result is promoted to the allocation size type.