A flaw was found in GStreamer gst-plugins-ugly (asfdemux). The ASF demuxer performed arithmetic on attacker-controlled length and size fields from ASF/WMV/WMA headers using 32-bit unsigned operations without adequate overflow and underflow checks. In gstasfdemuxprocessmetadata(), summing namelen and datalen could wrap, bypassing the available-data check and causing gconvert() to read beyond the heap buffer during UTF-16LE to UTF-8 conversion. Related underflow issues in other header parsers similarly produced oversized lengths and out-of-bounds reads. Because asfdemux is auto-plugged by playbin and decodebin, processing a crafted file can crash the application (denial of service) and may enable limited heap information disclosure via metadata handling. Fixed upstream in gst-plugins-ugly 1.28.6 (GStreamer-SA-2026-0075).