GStreamer ASF demuxer CVE-2026-112214

Exploitation requires a victim to process an attacker-crafted ASF, WMV, or WMA file through an application that uses the gst-plugins-ugly ASF demuxer; the malicious trigger is specifically a Simple Index object whose entry count is set larger than the actual payload, driving an unbounded heap allocation. Limiting factors that reduce real-world risk: mandatory user interaction (UI:R) to open or auto-preview the file, impact restricted to denial of service with no code execution or data exposure, and the crash materializing primarily when the allocation fails or the host is memory-constrained - on systems with abundant memory or overcommit the process may degrade rather than reliably crash.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) shows network-reachable, unauthenticated, low-complexity exploitation but is gated by UI:R - a victim must actively process a malicious media file - and impact is confined to availability (C:N/I:N) via a CWE-789 excessive memory allocation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no confirmed exploitation signal; EPSS data was not provided in the input, which limits probabilistic ranking. SSVC-style reasoning points to low urgency: technical impact is partial (a crash/OOM, no code execution or data compromise), exploitation is not automatable (requires user interaction and typically memory-constrained conditions), and exploitation status is 'none' per available data. The one caveat worth verifying: the description frames impact conditionally ('if the allocation fails or the process is memory-constrained'), meaning A:H may overstate real-world impact on systems with ample memory and overcommit - the crash is not guaranteed on every host.

An attacker crafts a malicious ASF/WMV/WMA file with an inflated Simple Index entry count and distributes it via a download, email attachment, or website. When a victim opens or previews the file in any application that uses the gst-plugins-ugly ASF demuxer, the parser attempts a very large heap allocation, causing the application (or the host, if memory-constrained) to crash or become unresponsive. No public exploit code has been identified, but the trigger is a simple malformed-field condition that is straightforward to reproduce.