A flaw was found in GStreamer gst-plugins-bad (adpcmdec). The IMA/DVI ADPCM decoder validated the per-block sample count with (n_samples - channels) % 8 == 0, which does not ensure alignment with the decode loop that writes 8 * channels samples per iteration. A crafted multi-channel IMA ADPCM WAV can pass this check and cause a heap out-of-bounds write of decoded sample values that are partially derived from attacker-controlled compressed audio data. The adpcmdec element is auto-plugged by decodebin/playbin, so processing untrusted media (players, thumbnailers, transcoders) can trigger the issue, resulting in application crash, denial of service, memory corruption, or potentially code execution. Fixed upstream in gst-plugins-bad 1.28.6 (GStreamer-SA-2026-0077).