CVE-2026-112214

Published: Oct 19, 2026Modified: Oct 19, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

Related CWEs

CWE-789

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (2)

https://access.redhat.com/security/cve/CVE-2026-112214

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2555538

Source: secalert@redhat.com

Timeline

No history available yet.