Heap-based Buffer Overflow in GStreamer ASF Demuxer

CVE-2026-2920

What is CVE-2026-2920?

The vulnerability in GStreamer's ASF Demuxer allows remote attackers to execute arbitrary code on affected installations. This security flaw arises from improper validation of user-supplied data length when processing stream headers within ASF files, potentially leading to a buffer overflow in a fixed-length heap-based buffer. By exploiting this weakness, an attacker can execute malicious code within the context of the current process, highlighting the need for vigilance and prompt patching.

References