GStreamer asfmux CVE-2026-100231

Exploitation requires an application that invokes GStreamer's asfmux plugin to mux, remux, or transcode media into the ASF/WMV container AND preserves string metadata tags from the attacker-supplied source. The malicious metadata must contain at least one Unicode code point outside the Basic Multilingual Plane (e.g. an emoji or supplementary-plane CJK character) to trigger the surrogate-pair miscalculation. Limiting factors that reduce realistic risk: the attack is local (AV:L) - the file must reach a local processing pipeline; it requires user interaction (UI:R) - a victim must actively run the ASF conversion; and it depends on the uncommon workflow of writing to the legacy Microsoft ASF format with metadata retention, which is not a default or widespread operation.

This is a medium-severity (CVSS 6.1) heap out-of-bounds write (CWE-787) whose real-world risk is modest and bounded by a narrow exploitation path rather than its memory-corruption primitive. The CVSS vector itself tempers the risk: AV:L means no remote network reachability (the malicious file must be processed locally) and UI:R means a victim must actively run a transcode/remux operation, while PR:N confirms no authentication is needed once that workflow is triggered. Impact is skewed toward availability (A:H, i.e. crashes/DoS) with only limited integrity impact (I:L) and no confidentiality impact (C:N), consistent with the description's framing of 'denial of service or limited memory corruption' rather than reliable code execution. No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical limiting factor - exploitation requires an application that specifically muxes/remuxes to the legacy ASF/WMV container while preserving attacker-controlled Unicode metadata - makes this far lower priority than its CWE-787 class would suggest in isolation. Note: although the product (GStreamer) is broadly deployed, the specific asfmux code path is rarely exercised, so the raw CVSS should not be read as fleet-wide exposure.

An attacker crafts a media file whose string metadata tags (e.g. title or artist) contain non-BMP Unicode characters such as emoji, then delivers it to a victim who runs a conversion pipeline that remuxes or transcodes to ASF format while preserving metadata. When GStreamer's asfmux plugin under-allocates the UTF-16LE buffer (2 bytes assumed per code point instead of 4 for surrogate pairs), the conversion writes past the heap allocation, crashing the process or corrupting adjacent memory. No public exploit code was identified in the provided data, and exploitation requires the victim to actively perform the ASF conversion (UI:R).