CVE-2026-112214
Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
CVE-2026-112214- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-05
EUVDEUVD-2026-104253
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
EUVD-2026-104253- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-ffx9-vqhr-x528
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index...
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
GHSA-ffx9-vqhr-x528- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
NVD
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
CVE-2026-112214- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-112214
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
DEBIAN-CVE-2026-112214- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-112214
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
- Record
UBUNTU-CVE-2026-112214- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-ugly1.0Debian:12 |
All versions, plus listed versions 1.22.0-21.22.0-2+deb12u11.22.0-2+deb12u21.22.1-11.22.10-1 Show 45 moreShow less1.22.3-11.22.3-21.22.4-11.22.5-11.22.6-11.22.7-11.22.8-11.22.9-11.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.10-11.24.11-11.24.12-11.24.2-11.24.3-11.24.4-11.24.5-11.24.6-11.24.7-11.24.8-11.24.9-11.25.1-11.25.50-11.25.50-21.25.90-11.25.90-21.26.0-11.26.1-11.26.10-11.26.2-11.26.3-11.26.3-21.26.3-31.26.3-41.26.4-11.26.5-11.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-1 |
None known |
gst-plugins-ugly1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.3-41.26.3-4+deb13u11.26.4-11.26.5-1 Show 21 moreShow less1.26.5-21.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-11.28.6-11.28.7-11.28.8-11.29.1-11.29.2-1 |
None known |
gst-plugins-ugly1.0Debian:14 |
All versions, plus listed versions 1.26.10-11.26.3-41.26.4-11.26.5-11.26.5-2 Show 20 moreShow less1.26.6-11.26.7-11.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.50-21.27.90-11.28.0-11.28.1-11.28.2-11.28.3-11.28.4-11.28.5-11.28.6-11.28.7-11.28.8-11.29.1-11.29.2-1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1 Show 8 moreShow less1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.3-1ubuntu0.11.8.3-1ubuntu0.1+esm11.8.3-1ubuntu0.1+esm2 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.12.3-11.12.3-1build11.12.4-11.12.4-1build11.13.1-1 Show 6 moreShow less1.13.91-11.14.0-11.14.1-1~ubuntu18.04.11.14.4-1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.1+esm1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.16.1-11.16.1-1build11.16.2-11.16.2-21.16.2-2build11.16.2-2ubuntu0.1~esm1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.18.5-11.20.0-11.20.0-1build11.20.1-11.20.1-1ubuntu0.1~esm1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.22.5-11.22.6-11.22.7-11.22.8-11.22.10-11.24.1-11.24.1-1build11.24.1-1ubuntu0.1~esm1 |
None known |
gst-plugins-ugly1.0Ubuntu:26.10 |
All versions, plus listed versions 1.28.2-11.28.3-11.28.4-11.28.6-11.28.7-1 |
None known |
gst-plugins-ugly1.0Ubuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.26.6-11.26.7-1build11.27.2-11.27.90-11.28.0-11.28.1-11.28.2-11.28.2-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-112214 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published October 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.
References
Left out here: 15 versions. The JSON record has them.