Security Advisory 2026-0101 (CVE-2026-XXXX pending)
| Summary | Out-of-bounds write in the ASF muxer when writing metadata with certain Unicode characters |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-bad >= 1.0 and < 1.28.9 |
| IDs | GStreamer-SA-2026-0101 CVE-2026-XXXX (pending) |
Details
The ASF muxer in gst-plugins-bad stores metadata tags as UTF-16 strings. The memory reserved for these strings assumes that every character occupies two bytes in UTF-16. Characters outside the Basic Multilingual Plane, such as many emoji, are encoded as surrogate pairs and occupy four bytes, which under-allocates the buffer holding the file header. When the header is written, the muxer then writes past the end of the allocated buffer.
This can happen whenever an application passes such tag values to the muxer, for example when tags from a source stream are forwarded to the file that is written. The bug was present since the muxer was first added in GStreamer 1.0.
The same merge request also contains a few other fixes for missing size checks in the ASF file parser and RTP packetizer.
Impact
A crafted metadata string can make the process write past the end of a heap buffer, leading to memory corruption and a crash, resulting in a denial of service. Under some circumstances out-of-bounds writes might also allow arbitrary code execution. The attack surface is limited as the application has to forward hostile tag values to the ASF muxer itself.
Solution
The gst-plugins-bad 1.28.9 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.