CVE-2026-100231

Awaiting Analysis Awaiting Analysis - Queue

Heap Out-of-Bounds Write in GStreamer ASF Muxer Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100231

EUVD

EUVD-2026-100953

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the GStreamer multimedia framework's ASF muxer plugin (asfmux). It occurs when writing string metadata tags with Unicode characters outside the Basic Multilingual Plane (like emoji) to an ASF container. The plugin incorrectly calculates the buffer size needed for UTF-16LE conversion, assuming each character uses 2 bytes. Non-BMP characters require 4 bytes, leading to an undersized buffer. When the actual UTF-16LE data is written, it causes a heap out-of-bounds write, potentially causing denial of service or limited memory corruption.

Detection Guidance

Check if the gstreamer1-plugins-bad-free package is installed using 'rpm -q gstreamer1-plugins-bad-free' on RHEL or 'dnf list installed gstreamer1-plugins-bad-free'. Look for the presence of the asfmux plugin with 'gst-inspect-1.0 | grep asfmux'. Monitor for crashes in applications using GStreamer with ASF muxing.

Impact Analysis

An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata. This could lead to denial of service or limited memory corruption on systems using affected GStreamer versions. Exploitation requires user interaction and processing untrusted media through a vulnerable pipeline.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a technical flaw in memory handling during media processing. However, if exploited, it could lead to denial of service or memory corruption in systems processing media, potentially disrupting operations that handle sensitive data. Compliance impact would be indirect, depending on system availability and integrity failures.

Mitigation Strategies

Disable the asfmux plugin by removing 'libgstasfmux.so' or set '-Dgst-plugins-bad:asfmux=disabled' during build. Avoid processing untrusted media with Unicode metadata in ASF pipelines. If ASF muxing is required, sanitize metadata to remove non-BMP characters before passing to asfmux.

Hi! I’m here to help you understand CVE-2026-100231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70