ALAS2023-2026-1926

References: CVE-2026-39043  CVE-2026-39044  CVE-2026-53705 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes. (from https://gstreamer.freedesktop.org/security/sa-2026-0022.html) (CVE-2026-39043)

An integer overflow in the WAV parser (wavparse) when handling malformed WAV files with cue chunks. The vulnerability occurs during buffer size validation when calculating the expected size for cue entries (ncues * 24), where insufficient bounds checking allows integer overflow during the multiplication operation. (from https://gstreamer.freedesktop.org/security/sa-2026-0021.html) (CVE-2026-39044)

A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption. This affects both 32-bit and 64-bit systems since the arithmetic is performed in 32-bit integers before promotion to the allocation size type. A remote attacker could use this flaw to crash an application or potentially execute arbitrary code by convincing a user to open a malicious WavPack audio file. (CVE-2026-53705)

Issue Correction:
Run dnf update gstreamer1-plugins-good --releasever 2023.12.20260706 or dnf update --advisory ALAS2023-2026-1926 --releasever 2023.12.20260706 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    gstreamer1-plugins-good-gtk-debuginfo-1.24.10-1.amzn2023.0.7.aarch64
    gstreamer1-plugins-good-gtk-1.24.10-1.amzn2023.0.7.aarch64
    gstreamer1-plugins-good-debuginfo-1.24.10-1.amzn2023.0.7.aarch64
    gstreamer1-plugins-good-debugsource-1.24.10-1.amzn2023.0.7.aarch64
    gstreamer1-plugins-good-1.24.10-1.amzn2023.0.7.aarch64

src:
    gstreamer1-plugins-good-1.24.10-1.amzn2023.0.7.src

x86_64:
    gstreamer1-plugins-good-gtk-debuginfo-1.24.10-1.amzn2023.0.7.x86_64
    gstreamer1-plugins-good-gtk-1.24.10-1.amzn2023.0.7.x86_64
    gstreamer1-plugins-good-debugsource-1.24.10-1.amzn2023.0.7.x86_64
    gstreamer1-plugins-good-1.24.10-1.amzn2023.0.7.x86_64
    gstreamer1-plugins-good-debuginfo-1.24.10-1.amzn2023.0.7.x86_64