Description

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T03:16:40.380Z",
  "pubdate": "2026-08-10T03:16:40.380Z",
  "executiveSummary": "Multiple integer overflow and underflow vulnerabilities have been identified within the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) component.\nThese vulnerabilities arise during the parsing of header objects from maliciously crafted ASF, WMV, or WMA media files due to insufficient validation of attacker-controlled length and size values.\nSuccessful exploitation of these flaws allows an adversary to bypass established memory bounds checks, directly resulting in out-of-bounds heap read conditions.\nThe primary impact of these security defects includes application crashes leading to denial of service, as well as limited information disclosure resulting from unauthorized memory reads.\nExploitation requires a user or automated system to process an untrusted, malformed media file through the vulnerable GStreamer pipeline.\nNo specific authentication or elevated privilege requirements are necessary beyond the capability to supply a crafted media file to the vulnerable application.\nRisk implications remain significant for systems that ingest and process arbitrary user-supplied media streams without prior sanitization or robust input validation.",
  "technicalDetails": "The root cause of the vulnerability resides in the asfdemux component of the GStreamer gst-plugins-ugly plugin suite, specifically within the routines responsible for parsing header objects from ASF, WMV, and WMA file formats.\nDuring the parsing phase, the demuxer extracts length and size values directly from untrusted file headers without performing adequate arithmetic validation or overflow checks.\nWhen an attacker supplies maliciously crafted integer values designed to trigger arithmetic overflows or underflows, subsequent buffer allocation and size calculations yield incorrect results.\nThese corrupted size calculations successfully bypass the intended memory bounds checks implemented within the demuxer logic.\nStep-by-step attack flow begins when an application utilizes the vulnerable asfdemux parser to open and process an attacker-controlled ASF, WMV, or WMA file.\nAs the parser evaluates the malicious header objects, the unchecked arithmetic operations result in integer overflow or underflow conditions.\nThe resulting invalid size parameters are subsequently passed to memory read operations, causing the application to read data from unintended heap memory locations outside the allocated buffer boundaries.\nThis out-of-bounds heap read operation can expose sensitive data residing adjacent to the buffer, leading to limited information disclosure.\nAlternatively, if the out-of-bounds read encounters unmapped memory regions, the process triggers an access violation, resulting in an application crash and subsequent denial of service.\nThe vulnerable component is the asfdemux module within the GStreamer gst-plugins-ugly package.\nNetwork exposure and privilege requirements depend on the host application architecture; however, local or remote processing of untrusted media files constitutes the primary attack vector.\nNo authentication or special privileges are required by the threat actor beyond the ability to deliver the malformed media payload to the parsing engine."
}