EUVD-2026-54987
GHSA-p44h-f9j6-g9ff
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Network delivery of crafted media file requires no privileges; user must open file (UI:R); heap read yields limited disclosure (C:L) and crash (A:H) but no write primitive.
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
AnalysisAI
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
GStreamer is an open-source multimedia pipeline framework widely used on Linux desktops and embedded systems. The affected component is the ASF (Advanced Systems Format) demuxer in the gst-plugins-ugly package, which parses Microsoft's ASF container format used by WMV (video) and WMA (audio) files. CWE-190 (Integer Overflow or Wraparound) describes the root cause: attacker-supplied 32- or 64-bit length/size values in ASF header objects are combined via arithmetic operations that overflow or underflow before bounds checks are applied, producing a smaller-than-expected result. This allows subsequent heap reads to exceed allocated buffer boundaries. The CPE strings confirm affected platforms are Red Hat Enterprise Linux 7, 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*), but the upstream flaw exists in the GStreamer project itself, patched in the 1.28 release per the upstream release notes at gstreamer.freedesktop.org/releases/1.28/.
RemediationAI
The primary fix is upgrading GStreamer (gst-plugins-ugly) to version 1.28 or later, as documented in the upstream security advisory SA-2026-0075 at https://gstreamer.freedesktop.org/security/sa-2026-0075.html and the release announcement at https://gstreamer.freedesktop.org/releases/1.28/. On Red Hat Enterprise Linux systems, apply the vendor-issued errata tracked at https://access.redhat.com/security/cve/CVE-2026-19389 once published. If patching is not immediately possible, a targeted compensating control is to remove or disable the gst-plugins-ugly package entirely - this eliminates ASF/WMV/WMA demuxing capability but prevents exploitation; note this will break playback of those file formats system-wide. Alternatively, configure application-level policies (e.g., GStreamer plugin blacklists or AppArmor/SELinux profiles) to deny asfdemux loading in exposed contexts such as web browsers, email clients, or file managers that auto-generate thumbnails from media. Organizations with automated media-processing pipelines handling untrusted content should treat patching as high priority even absent active exploitation evidence.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today