EUVD-2026-54987
GHSA-p44h-f9j6-g9ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious ASF/WMV/WMA file with overflowed size fields
-
DeliveryDeliver file via web, email, or network share
-
ExploitVictim opens file in GStreamer-backed application
-
Executionasfdemux parses header object with insufficient length validation
-
PersistInteger overflow bypasses bounds check
-
ImpactOut-of-bounds heap read triggers crash or leaks partial heap data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim open or cause a GStreamer pipeline to process a crafted ASF, WMV, or WMA file - this is the mandatory user interaction reflected in the CVSS UI:R metric. No authentication is required from the attacker's perspective (CVSS PR:N), but the victim must actively or passively trigger media processing (e.g., playing a file, previewing a thumbnail, opening an email attachment). The specific limiting factor is that the gst-plugins-ugly package containing asfdemux must be installed; this package is not always present by default on all RHEL configurations. Additionally, the target application must use GStreamer with the asfdemux plugin active in its pipeline. Exploitation is further constrained to limited heap reads rather than arbitrary code execution, as no integrity impact is indicated (I:N in CVSS); elevation to code execution would require additional memory-corruption primitives not described in available data. |
| Impact | The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) reflects a realistic threat model: network delivery of a crafted file is trivial, complexity is low, and availability impact is high (crash/DoS), but user interaction is required - the victim must open or play the file. The confidentiality impact is limited to partial heap data leakage, not arbitrary read primitives. No EPSS data was provided in the source intelligence, and the CVE is not listed in the CISA KEV catalog, meaning there is no confirmed evidence of active in-the-wild exploitation. No public proof-of-concept code was identified in the references. From an SSVC lens: exploitation is not yet active or automated, technical impact is partial (DoS plus limited disclosure, no code execution confirmed), and the attack requires user interaction, moderately reducing urgency compared to fully automated network-exploitable flaws. The primary real-world risk is denial of service against media-processing pipelines or desktop users tricked into opening malicious WMV/WMA files; the information disclosure vector is secondary and may require memory-layout assumptions to be useful. |
| Exploit ScenarioDerived | An attacker crafts a malicious WMV or WMA file containing ASF header objects with deliberately overflowed size fields and hosts it on a web page or delivers it via email. When a victim opens the file in any GStreamer-backed application - a video player, browser plugin, or file manager thumbnail generator - the asfdemux parser processes the malformed header, the integer overflow bypasses the bounds check, and an out-of-bounds heap read occurs, crashing the application or leaking partial heap contents to the attacker if a side-channel for error output is available. No public proof-of-concept code has been identified, but the attack primitive (malicious media file requiring one user action) is straightforward to construct given the vulnerability class. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 10, 2026
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
The primary fix is upgrading GStreamer (gst-plugins-ugly) to version 1.28 or later, as documented in the upstream security advisory SA-2026-0075 at https://gstreamer.freedesktop.org/security/sa-2026-0075.html and the release announcement at https://gstreamer.freedesktop.org/releases/1.28/. On Red Hat Enterprise Linux systems, apply the vendor-issued errata tracked at https://access.redhat.com/security/cve/CVE-2026-19389 once published. If patching is not immediately possible, a targeted compensating control is to remove or disable the gst-plugins-ugly package entirely - this eliminates ASF/WMV/WMA demuxing capability but prevents exploitation; note this will break playback of those file formats system-wide. Alternatively, configure application-level policies (e.g., GStreamer plugin blacklists or AppArmor/SELinux profiles) to deny asfdemux loading in exposed contexts such as web browsers, email clients, or file managers that auto-generate thumbnails from media. Organizations with automated media-processing pipelines handling untrusted content should treat patching as high priority even absent active exploitation evidence.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is an open-source multimedia pipeline framework widely used on Linux desktops and embedded systems. The affected component is the ASF (Advanced Systems Format) demuxer in the gst-plugins-ugly package, which parses Microsoft's ASF container format used by WMV (video) and WMA (audio) files. CWE-190 (Integer Overflow or Wraparound) describes the root cause: attacker-supplied 32- or 64-bit length/size values in ASF header objects are combined via arithmetic operations that overflow or underflow before bounds checks are applied, producing a smaller-than-expected result. This allows subsequent heap reads to exceed allocated buffer boundaries. The CPE strings confirm affected platforms are Red Hat Enterprise Linux 7, 8, 9, and 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_*), but the upstream flaw exists in the GStreamer project itself, patched in the 1.28 release per the upstream release notes at gstreamer.freedesktop.org/releases/1.28/.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Network delivery of crafted media file requires no privileges; user must open file (UI:R); heap read yields limited disclosure (C:L) and crash (A:H) but no write primitive.
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
Executive ViewAI
GStreamer's media processing plugin contains integer overflow vulnerabilities affecting any application that handles media files-including web browsers, media players, and thumbnail generators. Organizations face denial-of-service and data leak risks whenever users open untrusted audio or video content, with no vendor patch currently available to remediate the flaw.
Restrict processing of untrusted media files; disable ASF/WMV/WMA demuxing in GStreamer configurations where not essential; implement file type validation and format restrictions at application entry points; sandbox media processing in isolated environments; educate users against opening untrusted media from unknown sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Related Vulnerabilities in GStreamer gst-plugins Parsing Vulnerabilities
View all 2More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB