CVE-2026-112214Medium· 6.5▾ SunlitA flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Pro…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.
gstreamer1-plugins-ugly-free (all versions)gstreamer1-plugins-ugly-freegstreamer1-plugins-ugly-freegstreamer1-plugins-ugly-free (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Avoid opening untrusted ASF, WMV, or WMA files in GStreamer-based applications (including local players and media indexers/thumbnailers).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112048Medium· 6.1libspatialite: libspatialite: Denial of Service via uncontrolled memory allocation during polygon parsing (CVE-2026-112048)
CVE-2026-33374Medium· 6.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
CVE-2026-108106High· 7.5Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input
CVE-2026-15567High· 7.5A flaw was found in Wildfly
CVE-2026-53704High· 7.1A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package
CVE-2026-19389High· 7.1Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files