CVE-2026-19389
Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
CVSS Score
7.1
EPSS Score
0.3%
EPSS Percentile
27th
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
| CWE | CWE-190 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Aug 10, 2026 |
| Last Updated | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new high vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:55435 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:55865 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67883 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67930 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:67931 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-19389 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2513016 gitlab.freedesktop.org: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12233 gstreamer.freedesktop.org: https://gstreamer.freedesktop.org/releases/1.28/ gstreamer.freedesktop.org: https://gstreamer.freedesktop.org/security/sa-2026-0075.html
Credits
Red Hat would like to thank Seonwook Kim for reporting this issue.