CVE-2026-19389: Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
A flaw was found in GStreamer gst-plugins-ugly (asfdemux). The ASF demuxer performed arithmetic on attacker-controlled length and size fields from ASF/WMV/WMA headers using 32-bit unsigned operations without adequate overflow and underflow checks. In gstasfdemuxprocessmetadata(), summing namelen and datalen could wrap, bypassing the available-data check and causing gconvert() to read beyond the heap buffer during UTF-16LE to UTF-8 conversion. Related underflow issues in other header parsers similarly produced oversized lengths and out-of-bounds reads. Because asfdemux is auto-plugged by playbin and decodebin, processing a crafted file can crash the application (denial of service) and may enable limited heap information disclosure via metadata handling. Fixed upstream in gst-plugins-ugly 1.28.6 (GStreamer-SA-2026-0075).
Other sources
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-ugly (asfdemux)to a version that resolves this vulnerability.Fixed in 1.28.6Patch GStreamer-SA-2026-0075 - Compensating control
Because asfdemux is auto-plugged by playbin and decodebin, avoid processing untrusted media in applications that use these elements (e.g., do not let the app open attacker-supplied ASF/WMV/WMA files).
- Operational
After upgrading gst-plugins-ugly to 1.28.6, restart/redeploy the application components using playbin/decodebin so the updated asfdemux code is loaded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19389?
The severity of CVE-2026-19389 is rated as high with a score of 7.1.
How do I fix CVE-2026-19389?
To fix CVE-2026-19389, update the GStreamer gst-plugins-ugly to the latest version that addresses this vulnerability.
What vulnerabilities are associated with CVE-2026-19389?
CVE-2026-19389 is associated with multiple integer overflow and underflow vulnerabilities in the GStreamer ASF demuxer.
What types of files are affected by CVE-2026-19389?
CVE-2026-19389 affects crafted ASF, WMV, or WMA files when processed by the GStreamer ASF demuxer.
What is the impact of CVE-2026-19389?
CVE-2026-19389 can lead to out-of-bounds read vulnerabilities due to insufficient validation of length and size values.