Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by redhat

CVE-2026-112214Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

Medium 6.5

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 89.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gst-plugins-ugly1.0no fix listedDEBIAN-CVE-2026-112214
Debian:13gst-plugins-ugly1.0no fix listedDEBIAN-CVE-2026-112214
Debian:14gst-plugins-ugly1.0no fix listedDEBIAN-CVE-2026-112214
Ubuntu:26.10gst-plugins-ugly1.0no fix listedUBUNTU-CVE-2026-112214

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References