Amazon Linux 2 Security Advisory: ALAS2-2026-3788
Advisory Released Date: 2026-07-08
Advisory Updated Date: 2026-07-08
FAQs regarding Amazon Linux ALAS/CVE Severity
Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes. (from https://gstreamer.freedesktop.org/security/sa-2026-0022.html) (CVE-2026-39043)
An integer overflow in the WAV parser (wavparse) when handling malformed WAV files with cue chunks. The vulnerability occurs during buffer size validation when calculating the expected size for cue entries (ncues * 24), where insufficient bounds checking allows integer overflow during the multiplication operation. (from https://gstreamer.freedesktop.org/security/sa-2026-0021.html) (CVE-2026-39044)
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)
Affected Packages:
gstreamer1-plugins-good
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gstreamer1-plugins-good or yum update --advisory ALAS2-2026-3788 to update your system.
aarch64:
gstreamer1-plugins-good-1.18.4-6.amzn2.0.12.aarch64
gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.12.aarch64
gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.12.aarch64
i686:
gstreamer1-plugins-good-1.18.4-6.amzn2.0.12.i686
gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.12.i686
gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.12.i686
src:
gstreamer1-plugins-good-1.18.4-6.amzn2.0.12.src
x86_64:
gstreamer1-plugins-good-1.18.4-6.amzn2.0.12.x86_64
gstreamer1-plugins-good-gtk-1.18.4-6.amzn2.0.12.x86_64
gstreamer1-plugins-good-debuginfo-1.18.4-6.amzn2.0.12.x86_64