{"id":"CVE-2026-112214","kind":"vulnerability","aliases":["CVE-2026-112214"],"related":[],"title":"GStreamer: crafted ASF file can trigger oversized allocation and crash","description":"A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.","summary":"A flaw in the GStreamer ASF demuxer in gst-plugins-ugly lets a crafted ASF, WMV or WMA file set an attacker-controlled entry count in a Simple Index object that sizes a heap allocation without bounds. An attacker gets a denial of service when the allocation fails or the process runs out of memory.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gstreamer","media-processing","package","self-hosted"],"not_affected_if":["asf-not-decoded","no-untrusted-media"],"how_to_check":"- Check the installed gst-plugins-ugly version with `gst-inspect-1.0 asfdemux` or your package manager's query, such as `dpkg -l | grep gst-plugins-ugly`\n- Find services that decode untrusted ASF, WMV or WMA media with GStreamer","fix":"- Move gst-plugins-ugly to the fixed release from your distribution or upstream, version unknown from the sources\n- Until patched, reject or do not decode untrusted ASF, WMV or WMA input","status":"open","published_at":"2026-10-19T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:57:04+00:00","updated_at":"2026-10-25T03:57:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move gst-plugins-ugly to the fixed release from your distribution or upstream, version unknown from the sources\n- Until patched, reject or do not decode untrusted ASF, WMV or WMA input","reach":"unknown","title":"GStreamer: crafted ASF file can trigger oversized allocation and crash","impact":"low","summary":"A flaw in the GStreamer ASF demuxer in gst-plugins-ugly lets a crafted ASF, WMV or WMA file set an attacker-controlled entry count in a Simple Index object that sizes a heap allocation without bounds. An attacker gets a denial of service when the allocation fails or the process runs out of memory.","category":"package","nicknames":[],"who_cares":["gstreamer","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Crafted media file crashes the process through memory exhaustion","analyst_note":"","how_to_check":"- Check the installed gst-plugins-ugly version with `gst-inspect-1.0 asfdemux` or your package manager's query, such as `dpkg -l | grep gst-plugins-ugly`\n- Find services that decode untrusted ASF, WMV or WMA media with GStreamer","needs_analyst":false,"not_affected_if":["no-untrusted-media","asf-not-decoded"],"who_is_affected":"Systems that parse ASF, WMV or WMA files with GStreamer's asfdemux element, such as media servers, transcoders or upload pipelines that accept user media. Applications that never decode untrusted ASF input can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3347,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112214':13A,16A '-2026':12A,15A 'alloc':8A,61B,73B,114C,139C,149C 'asf':3A,30B,40B,89C,128C 'attack':48B,65B,104C 'attacker-control':47B,103C 'avail':121C 'bound':63B 'caus':134C 'constrain':157C 'control':49B,105C 'count':51B,107C 'craft':2A,39B,127C 'crash':10A 'cve':11A,14A 'demux':31B,90C 'denial':68B,144C 'entri':50B,106C 'fail':74B,150C 'file':4A,44B,132C 'flaw':26B,83C 'found':85C 'get':66B 'gst':34B,93C 'gst-plugins-ug':33B,92C 'gstreamer':1A,17B,29B,88C 'heap':60B,113C 'host':24B 'index':55B,100C 'larg':137C 'lead':142C 'let':37B 'limit':117C 'media':19B 'media-process':18B 'memori':81B,138C,156C 'memory-constrain':155C 'object':56B,101C,124C 'overs':7A 'packag':21B 'pars':97C 'payload':120C 'plugin':35B,94C 'process':20B,77B,125C,153C 'request':140C 'run':78B 'self':23B 'self-host':22B 'servic':70B,146C 'set':45B 'simpl':54B,99C 'size':58B,111C 'trigger':6A 'ugli':36B,95C 'use':109C 'without':62B,115C 'wma':43B,131C 'wmv':41B,129C","nicknames":[],"mitigations":[],"who_affected":"Systems that parse ASF, WMV or WMA files with GStreamer's asfdemux element, such as media servers, transcoders or upload pipelines that accept user media. Applications that never decode untrusted ASF input can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112214","severity":null,"published_at":"2026-10-19T13:16:57+00:00","modified_at":"2026-10-19T21:03:27+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}