Skip to content

CVE-2026-19389 on CTRL-OS 26.05

Aliases: CVE-2026-19389

Packages: gst_all_1.gst-plugins-ugly

Status: Plausible

Advisory Information

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.

Updates

2026-08-24 11:24 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-ugly: “Plausible”

2026-08-24 11:07 CEST

Metadata changes:

  • Status for package gst_all_1.gst-plugins-ugly: “New”

(Amended on: 2026-08-24 11:08 CEST)