CVE-2026-19389 Integer overflow in Red Hat Enterprise Linux 10
Attackers can cause crashes or leak memory by processing crafted media files due to integer overflows in the GStreamer ASF demuxer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19389?
CVE-2026-19389 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information disclosure when untrusted media is processed.
Weakness: CWE-190
Which versions are affected by CVE-2026-19389?
Linux distribution packages (17)
gstreamer1-plugins-ugly-free AlmaLinux:10 | All versions | 1.26.7-2.el10_2.2 |
gstreamer1-plugins-ugly-free Red Hat:enterprise_linux:10.2 | All versions | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-ugly-free-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-ugly-free-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.26.7-2.el10_2.2 |
gstreamer1-plugins-ugly-free Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-free-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-free-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.24.11-1.el10_0.3 |
gstreamer1-plugins-ugly-free Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-free-debuginfo Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-free-debugsource Red Hat:rhel_e4s:9.2::appstream | All versions | 0:1.18.4-4.el9_2 |
gstreamer1-plugins-ugly-free Red Hat:rhel_e4s:9.4::appstream | All versions | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-free-debuginfo Red Hat:rhel_e4s:9.4::appstream | All versions | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-free-debugsource Red Hat:rhel_e4s:9.4::appstream | All versions | 0:1.22.1-2.el9_4 |
gstreamer1-plugins-ugly-free Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-free-debuginfo Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-free-debugsource Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.22.12-4.el9_6.2 |
gstreamer1-plugins-ugly-free Rocky Linux:10 | All versions | 0:1.26.7-2.el10_2.2 |
How do I fix CVE-2026-19389?
Apply the vendor's patch.
Is CVE-2026-19389 being exploited?
There is no known exploitation of CVE-2026-19389 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:55435, CLSA-2026-1787309460, DEBIAN-CVE-2026-19389, GHSA-p44h-f9j6-g9ff, RHSA-2026:55435, RHSA-2026:67882 and 5 more.