Security Advisory 2026-0087
|
|
| Summary |
Excessive memory allocation in the ASF demuxer |
| Date |
2026-10-08 |
| Affected Versions |
GStreamer gst-plugins-ugly < 1.28.8 |
| IDs |
GStreamer-SA-2026-0087 |
Details
An unvalidated entry count in the simple index object parser of the ASF demuxer
in gst-plugins-ugly when parsing crafted ASF files. The number of entries is not
bounded by the data actually present in the object, allowing a single small
object to trigger a memory allocation of up to 32 GB.
Impact
A malicious third party could trigger a large memory allocation or an
immediate crash of the application by supplying a crafted ASF file, resulting
in denial of service through memory exhaustion.
Solution
The gst-plugins-ugly 1.28.8 release addresses the issue. People using older
versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
- No CVE number assigned or pending
GStreamer 1.28.8 release
Patches
