GStreamer ASF Demuxer Integer Overflow/Underflow
Integer overflow and underflow in GStreamer's ASF demuxer let crafted ASF, WMV, or WMA headers bypass bounds checks, triggering out-of-bounds heap reads in gst-plugins-ugly.
- Vendor
- GStreamer Project
- Product
- gst-plugins-ugly
- CVSS
- 7.1
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-19389 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-19389 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-19389 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Multiple integer overflow and underflow flaws in the ASF demuxer component of gst-plugins-ugly allow attacker-controlled length and size values parsed from .asf, .wmv, or .wma file headers to bypass bounds checks. The result is out-of-bounds heap reads that can lead to crash, denial of service, or limited information disclosure.
Patch: update gst-plugins-ugly from your distribution. Red Hat advisory: CVE-2026-19389.
Other GStreamer Project CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-19387 GStreamer ADPCM Decoder Heap Out-of-Bounds Writewrite-up | [ HIGH ] | 7.6 | 0.4% | — |
