Vulnerability in GStreamer Multimedia Framework's ASF Muxer Plugin

CVE-2026-100231

What is CVE-2026-100231?

A security flaw exists within the ASF muxer plugin of the GStreamer multimedia framework. This flaw arises when the plugin processes string metadata tags with Unicode characters beyond the Basic Multilingual Plane, such as emojis. The plugin erroneously estimates the required buffer size for the UTF-16LE encoding, assuming that every Unicode character consumes 2 bytes. However, characters that fall outside of the Basic Multilingual Plane necessitate 4 bytes due to surrogate pairs. This mismatch can lead to heap out-of-bounds writes when the conversion data is written to the incorrectly sized buffer. Consequently, an attacker could exploit this vulnerability by supplying specially crafted media with malicious metadata, risking denial of service or limited memory corruption in applications that handle ASF format media.

References