Security Advisory 2026-0087 (CVE-2026-112214)
| Summary | Excessive memory allocation in the ASF demuxer |
| Date | 2026-10-08 |
| Affected Versions | GStreamer gst-plugins-ugly < 1.28.8 |
| IDs | GStreamer-SA-2026-0087 CVE-2026-112214 |
Details
An unvalidated entry count in the simple index object parser of the ASF demuxer in gst-plugins-ugly when parsing crafted ASF files. The number of entries is not bounded by the data actually present in the object, allowing a single small object to trigger a memory allocation of up to 32 GB.
Impact
A malicious third party could trigger a large memory allocation or an immediate crash of the application by supplying a crafted ASF file, resulting in denial of service through memory exhaustion.
Solution
The gst-plugins-ugly 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.