CVE-2026-19389: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-19389 is an integer overflow and underflow vulnerability in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) that causes out-of-bounds heap reads when parsing crafted ASF, WMV, or WMA media files. The flaw was reported by Seonwook Kim, published on August 5–10, 2026, and fixed upstream in gst-plugins-ugly 1.28.6 (GStreamer Security Advisory SA-2026-0075). Affected products include GStreamer gst-plugins-ugly prior to 1.28.6, as well as Red Hat Enterprise Linux 9 and 10 distributions shipping vulnerable package versions. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Github Advisory).

The root cause is CWE-190 (Integer Overflow or Wraparound): the ASF demuxer performs 32-bit unsigned arithmetic on attacker-controlled name_len and data_len fields from ASF/WMV/WMA header objects without adequate overflow or underflow checks. In gst_asf_demux_process_metadata(), summing these two fields can wrap around, bypassing the available-data bounds check and causing g_convert() to read beyond the allocated heap buffer during UTF-16LE to UTF-8 conversion. Related underflow issues in other header parsers similarly produce oversized lengths leading to additional out-of-bounds reads. Because asfdemux is auto-plugged by GStreamer's playbin and decodebin elements, simply opening a crafted media file is sufficient to trigger the vulnerability — no special configuration is required (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in application crash (denial of service) and limited heap memory disclosure when untrusted ASF, WMV, or WMA media is processed. The confidentiality impact is limited — only partial heap data may be exposed — and there is no integrity impact. Because the demuxer is automatically invoked by common GStreamer playback pipelines, any application using playbin or decodebin to handle user-supplied media is at risk, broadening the affected asset scope beyond dedicated media players to any software embedding GStreamer for media processing (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable, as user interaction (opening a crafted file) is required. The EPSS score is approximately 0.24–0.26%, placing it in the 18th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Red Hat CVE).

1. Craft a malicious media file: Create a specially crafted ASF, WMV, or WMA file with manipulated name_len and data_len fields in the ASF header metadata objects such that their 32-bit unsigned sum wraps around (integer overflow), producing a value smaller than the actual data size.
2. Bypass bounds check: The wrapped sum passes the available-data check in gst_asf_demux_process_metadata(), as the computed total appears within bounds.
3. Trigger out-of-bounds read: When g_convert() is called to convert the metadata string from UTF-16LE to UTF-8, it reads beyond the allocated heap buffer using the attacker-controlled (overflowed) length value.
4. Deliver the file to the target: Distribute the crafted file via email attachment, web download, or shared storage. The target user opens the file with any GStreamer-based media player or application using playbin/decodebin.
5. Achieve impact: The application crashes (denial of service), and heap memory contents adjacent to the buffer may be disclosed through error handling or metadata output, enabling limited information leakage (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or suspicious .asf, .wmv, or .wma files in download directories, temporary folders, or email attachment staging areas, particularly files with anomalously small or zero-byte apparent sizes but non-trivial header structures.
• Process: GStreamer-based media player processes (e.g., totem, rhythmbox, gst-launch-1.0) terminating unexpectedly with segmentation faults or memory access errors shortly after opening a media file.
• Logs: Application crash logs or core dumps referencing asfdemux, gst_asf_demux_process_metadata, or g_convert in stack traces; system journal entries showing SIGSEGV or SIGABRT for GStreamer processes.
• Network: Unusual inbound delivery of .asf/.wmv/.wma files from untrusted external sources via HTTP, email, or file-sharing protocols, especially files with atypical header sizes.

The upstream fix is available in gst-plugins-ugly 1.28.6 (GStreamer Security Advisory SA-2026-0075). Red Hat has released patched packages via two security advisories: RHSA-2026:55435 for Red Hat Enterprise Linux 10 (fixed package: gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.2) and RHSA-2026:55865 for Red Hat Enterprise Linux 9 (fixed packages: gstreamer1-plugins-ugly-free-1.22.12-6.el9_8.2 and gstreamer1-plugins-bad-free-1.22.12-7.el9_8.4). Red Hat notes that no practical configuration-based mitigation is available, so upgrading to the patched package versions is the recommended and only reliable remediation (Red Hat RHSA-2026:55435, Red Hat RHSA-2026:55865, Red Hat CVE).

Red Hat classified this vulnerability as Important severity, noting that the risk is amplified by asfdemux being automatically utilized by GStreamer's common playback elements in Red Hat products. The vulnerability was credited to researcher Seonwook Kim. Coverage has been picked up by standard vulnerability aggregators (VulDB, Vulners, CIRCL, ENISA EUVD) and Linux security news outlets including pro-linux.de and linuxsecurity.com, but no significant broader media or social media discussion has been identified (Red Hat CVE, Red Hat Bugzilla).