CVE-2026-19389 describes multiple integer overflow and underflow vulnerabilities in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) used in Red Hat Enterprise Linux 10. The vulnerabilities arise from insufficient validation of attacker-controlled length and size values when parsing header objects from crafted ASF, WMV, or WMA files. This can bypass bounds checks and cause out-of-bounds heap reads, potentially resulting in application crashes, denial of service, or limited heap information disclosure. The demuxer is automatically used by common GStreamer playback elements, increasing exposure. Red Hat has rated this flaw as Important and released updated gstreamer1-plugins-ugly-free packages to fix the issue. The CVSS v3.1 base score is 7.1 (High severity) with network attack vector, low complexity, no privileges required, and user interaction required.

The vulnerabilities can cause denial of service through application crashes or instability when processing maliciously crafted ASF/WMV/WMA media files. Additionally, limited information disclosure from out-of-bounds heap reads is possible. The flaws do not impact integrity but affect availability and confidentiality to a limited extent. Exploitation requires user interaction (e.g., opening a crafted media file). No known exploits are reported in the wild at this time.

Red Hat has released updated gstreamer1-plugins-ugly-free packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update RHSA-2026:55435 or later to remediate the issue. No alternative mitigations meeting Red Hat's criteria for ease of use, deployment, or stability are currently available. Applying the official patch is the recommended remediation.