CVE-2026-19389 describes multiple integer overflow and underflow vulnerabilities in the GStreamer gst-plugins-ugly ASF demuxer component (asfdemux) within Red Hat Enterprise Linux 10. These vulnerabilities arise from insufficient validation of attacker-controlled length and size values in header objects of ASF, WMV, or WMA media files. This allows bounds checks to be bypassed, resulting in out-of-bounds heap reads. The impact includes application crashes, denial of service, and limited heap information disclosure. The demuxer is automatically used by GStreamer's common playback elements, increasing exposure. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. The CVSS v3.1 score is 7.1 (high severity) with network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

The vulnerabilities can cause application crashes and denial of service when processing specially crafted ASF, WMV, or WMA files. Additionally, limited information disclosure from out-of-bounds heap reads is possible. The demuxer is commonly used by GStreamer playback elements, which may increase the risk of exposure. There is no indication of integrity compromise or remote code execution from the provided data. No known exploits in the wild have been reported.

Red Hat states that no mitigation is currently available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates and consider applying fixes once they become available. Until then, cautious handling of untrusted ASF, WMV, or WMA media files is advised. Customers with Red Hat Technical Account Managers can seek direct guidance. No official patch or workaround is currently provided.