Is CVE-2026-112214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112214 being exploited in the wild.

How severe is CVE-2026-112214?

Medium severity, with a CVSS score of 6.5, published 19 October 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Ugly ; Red Hat Gstreamer1-Plugins-Ugly-Free .

How is CVE-2026-112214 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112214?

Check whether you run Gstreamer Gst-Plugins-Ugly or Red Hat Gstreamer1-Plugins-Ugly-Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112214: GStreamer gst-plugins-ugly ASF demuxer unbounded memory allocation

CVE-2026-112214 · Severity: medium · CVSS 6.5 · Published 2026-10-19

GStreamer is a multimedia framework used by media players and indexing applications to process audio and video files. A flaw in the ASF/WMV/WMA file parser allows an attacker to craft a malicious media file that triggers an excessively large memory allocation request, causing the application to crash or consume excessive memory. An attacker can exploit this by distributing a crafted media file that victims process through GStreamer-based applications.

Technologies: Gstreamer Gst-Plugins-Ugly. Vendors: Gstreamer, Red Hat.

Quick answers

Is CVE-2026-112214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112214 being exploited in the wild.
How severe is CVE-2026-112214?: Medium severity, with a CVSS score of 6.5, published 19 October 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Ugly <UNKNOWN>; Red Hat Gstreamer1-Plugins-Ugly-Free <UNKNOWN>.
Is there a fix for CVE-2026-112214?: No fixed version is recorded yet. Avoid opening untrusted ASF, WMV, or WMA files in GStreamer-based applications, including local media players and media indexers or thumbnail generators. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112214 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112214?: Check whether you run Gstreamer Gst-Plugins-Ugly or Red Hat Gstreamer1-Plugins-Ugly-Free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Avoid opening untrusted ASF, WMV, or WMA files in GStreamer-based applications, including local media players and media indexers or thumbnail generators.

Technical details

The vulnerability is an unbounded memory allocation (CWE-789) in the Simple Index parser of the ASF demuxer within gst-plugins-ugly. When parsing a crafted ASF, WMV, or WMA file, an attacker-controlled entry count is used directly to size a heap allocation via g_new0 without validation against the remaining object payload size. An unauthenticated remote attacker can trigger this by providing a malicious media file that requires processing, resulting in denial of service through memory exhaustion or allocation failure.

Affected products

GStreamer gst-plugins-ugly <UNKNOWN>
Red Hat gstreamer1-plugins-ugly-free <UNKNOWN>

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.