Threats Tagged 'cve-2026-19389'

A security vulnerability (CVE-2026-19389) has been identified in the gstreamer1-plugins-ugly-free package of the GStreamer streaming media framework. The flaw is an integer overflow/underflow in asfdemux bounds checks that can lead to an out-of-bounds read. Red Hat has issued an important security update for Red Hat Enterprise Linux 10 to address this issue. The vulnerability is rated with high severity by the source, though no CVSS score is provided. The update is available for multiple architectures including x86_64, ppc64le, and aarch64. Users of affected Red Hat Enterprise Linux 10 versions are advised to apply the update as detailed in the Red Hat advisory.

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.