Heap Memory Allocation Vulnerability in GStreamer ASF Demuxer by Red Hat
CVE-2026-112214

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112214?

A flaw exists within the GStreamer ASF demuxer that affects the handling of Simple Index objects. The vulnerability arises when an attacker can manipulate the entry count during parsing, leading to unbounded heap memory allocation based on this count. This may result in substantial memory requests when processing malicious ASF, WMV, or WMA files, potentially causing denial of service under memory-constrained conditions or when allocation failures occur.

References

https://access.redhat.com/security/cve/CVE-2026-112214
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2555538
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Robin "drzobin" Larsson for reporting this issue.
.