CVE-2026-112214

10th percentile - higher than 10% of all known CVEs

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

An attacker could deliver a crafted media file that, when processed, causes memory exhaustion and application crash, leading to denial of service. The risk affects systems processing ASF, WMV, or WMA files with GStreamer.

Update gst-plugins-ugly to a version containing the fix if available. Avoid processing untrusted media files or limit memory resources for GStreamer processes.