CVE-2026-112214: GStreamer ASF Demuxer DoS Vulnerability

CVE-2026-112214 Overview

CVE-2026-112214 is a memory allocation flaw in the GStreamer ASF demuxer shipped with gst-plugins-ugly. The vulnerability resides in the parser for the Simple Index object inside ASF, WMV, and WMA media containers. An attacker-controlled entry count is used to size a heap allocation without validation against the actual payload bytes present in the object. Processing a crafted media file triggers an oversized memory allocation request. The flaw is tracked as CWE-789: Memory Allocation with Excessive Size Value and results in denial of service when the allocation fails or the host is memory-constrained.

Critical Impact
A single crafted ASF, WMV, or WMA file opened by any GStreamer-based application can crash the media pipeline or exhaust system memory, disrupting services and user workflows.

Affected Products

GStreamer gst-plugins-ugly ASF demuxer component
Applications and desktop environments embedding GStreamer for media playback or transcoding
Linux distributions packaging gst-plugins-ugly (see the Red Hat CVE-2026-112214 Advisory for vendor-specific status)

Discovery Timeline

2026-10-19 - CVE-2026-112214 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-112214

Vulnerability Analysis

The ASF (Advanced Systems Format) container format defines a Simple Index object that enumerates seek points in a media stream. The demuxer reads an entry count field from the object header and uses it directly to compute a heap allocation size. The parser does not cross-check this count against the number of bytes actually available in the Simple Index object payload. An attacker crafts a file declaring millions of entries while providing a small payload. The demuxer multiplies the declared count by the per-entry structure size and requests the resulting buffer from the system allocator. The request either fails outright or forces the operating system to reclaim memory from other processes.

Exploitation requires user interaction, typically opening or previewing the file in a GStreamer-backed player, thumbnailer, or transcoder. The impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is missing input validation on an attacker-controlled length field prior to allocation. The demuxer trusts the declared entry count in the Simple Index object header without bounding it against the enclosing object size or any reasonable upper limit. This pattern matches CWE-789, where untrusted input drives memory allocation sizing.

Attack Vector

The attack vector is network-adjacent through file delivery. An attacker hosts or emails a crafted ASF, WMV, or WMA file. When a victim opens the file in any application built on GStreamer, the ASF demuxer parses the Simple Index object and triggers the oversized allocation. Server-side exposure exists where GStreamer is used for automated media processing such as thumbnail generation, transcoding pipelines, or inspection gateways. In those cases a single uploaded file can disrupt the processing service.

No public proof-of-concept is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list.

Detection Methods for CVE-2026-112214

Indicators of Compromise

Repeated crashes or SIGABRT terminations of processes linking libgstasf or gst-plugins-ugly
Kernel OOM-killer events targeting GStreamer-based media services shortly after a media file is processed
Spikes in resident memory for gst-launch, totem, rhythmbox, or custom pipelines when handling ASF, WMV, or WMA input

Detection Strategies

Hunt for process crash telemetry correlated with the file extensions .asf, .wmv, and .wma touched immediately before the crash
Inspect ingested media files for ASF Simple Index objects whose declared entry count is inconsistent with the object payload size
Alert on GStreamer worker processes whose virtual memory requests exceed baseline by orders of magnitude

Monitoring Recommendations

Enable crash reporting (systemd-coredump, abrt) on hosts running GStreamer-based services and forward reports to the SIEM
Monitor OOM-killer logs on media transcoding and thumbnailing servers
Track package versions of gst-plugins-ugly across the fleet to confirm patch deployment

How to Mitigate CVE-2026-112214

Immediate Actions Required

Apply the gst-plugins-ugly update from your Linux distribution once released; consult the Red Hat CVE-2026-112214 Advisory and the Red Hat Bug Report #2555538 for status
Inventory hosts and container images that ship gst-plugins-ugly and prioritize patching on servers that process untrusted media
Restrict automated pipelines from accepting ASF, WMV, and WMA inputs from untrusted sources until patched

Patch Information

At the time of publication, distribution-specific fixed versions are tracked in vendor advisories. Red Hat is coordinating the fix through Bug #2555538. Confirm the fixed package version with your distribution's security team before rolling out broadly.

Workarounds

Disable or uninstall gst-plugins-ugly on systems that do not require ASF, WMV, or WMA playback
Apply per-process memory limits using systemd unit directives such as MemoryMax= or cgroup v2 constraints to contain allocation failures
Pre-filter uploaded media through a format allow-list that excludes ASF-family containers until the patch is deployed

bash

# Enforce a memory ceiling on a GStreamer-based service unit
sudo systemctl edit gstreamer-worker.service
# Add the following override:
# [Service]
# MemoryMax=512M
# MemorySwapMax=0
sudo systemctl daemon-reload
sudo systemctl restart gstreamer-worker.service