CVE-2026-100231: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the GStreamer multimedia framework's ASF muxer plugin (asfmux) where it incorrectly calculates buffer size for UTF-16LE encoding of Unicode metadata tags containing non-BMP characters. The plugin assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes due to surrogate pairs. This results in a heap out-of-bounds write when the actual UTF-16LE data is written into an undersized buffer. An attacker can exploit this by supplying crafted metadata tags to an application that processes ASF containers with this plugin, leading to potential denial of service or limited memory corruption.

The vulnerability can cause a denial of service or limited memory corruption when an application using the vulnerable GStreamer ASF muxer plugin processes specially crafted metadata tags with non-BMP Unicode characters. There is no indication of confidentiality or availability impact beyond denial of service, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-100231 for current remediation guidance. Until a patch is applied, avoid processing ASF media with untrusted metadata containing non-BMP Unicode characters in affected environments.