Live › vulnerability › CVE-2026-112214
Go to dashboardA flaw in the GStreamer ASF demuxer in gst-plugins-ugly lets a crafted ASF, WMV or WMA file set an attacker-controlled entry count in a Simple Index object that sizes a heap allocation without bounds. An attacker gets a denial of service when the allocation fails or the process runs out of memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that parse ASF, WMV or WMA files with GStreamer's asfdemux element, such as media servers, transcoders or upload pipelines that accept user media. Applications that never decode untrusted ASF input can skip it.
No product ranges from the sources yet.
gst-inspect-1.0 asfdemux or your package manager's query, such as dpkg -l | grep gst-plugins-uglyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
This page as .md · .json · in your agent: get_signal("CVE-2026-112214")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.