CVE-2026-112214: Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
A flaw was found in the GStreamer ASF demuxer (gst-plugins-ugly). The Simple Index object parser reads an attacker-controlled entry count from the media and allocates an index table of that size with gnew0 without first clamping the count to the bytes remaining in the object. A crafted ASF, WMV, or WMA file can therefore request a very large heap allocation (on the order of tens of gigabytes of address space). When the allocation cannot be satisfied, or under memory limits, the application can abort or be terminated, resulting in denial of service. The parse loop stops when payload is exhausted, and GLib allocation helpers do not return an undersized buffer; this is not a heap buffer overflow.
Other sources
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the denial of service?
An attacker must persuade an application using the GStreamer ASF demuxer to process a crafted ASF, WMV, or WMA media file. No privileges are required, but user interaction is required to open or otherwise process the malicious media.
What is the practical impact of successful exploitation?
The crafted file can request a heap allocation on the order of tens of gigabytes of address space. If the allocation cannot be satisfied or the application is subject to memory limits, the process can abort or be terminated, causing denial of service.
Does this issue allow heap buffer overflow or memory corruption?
No. The parser loop stops when the payload is exhausted, and the GLib allocation helper does not return an undersized buffer; the described impact is denial of service from an excessive allocation request.