CVE-2026-1940

CVE-2026-1940 identifies an out-of-bounds read vulnerability within the gst_wavparse_adtl_chunk() function, resulting from an incomplete fix for a previous issue where size validation failed to account for byte alignment in offset calculations. While specific affected products are not detailed in the provided data, this flaw could allow a parser to read beyond validated memory bounds. It is rated with a CVSSv3.1 score of 5.1 (Medium), indicating a local attack vector with low complexity, requiring no privileges or user interaction, and potentially leading to low impacts on integrity and availability. There is currently no evidence of active exploitation, nor is public exploit code available. Community discussion and media coverage are absent, and its extremely low EPSS score suggests a very low probability of exploitation in the wild.