A flaw was discovered in the GStreamer 1.x ASF muxer plugin (asfmux). When processing string metadata tags that contain Unicode characters outside the Basic Multilingual Plane—such as emoji—the plugin incorrectly calculates the size of the UTF‑16LE representation. It assumes two bytes per code point, while each non‑BMP character actually occupies four bytes as a surrogate pair. Consequently the allocated buffer is too small and the UTF‑16LE conversion overflows, causing an out‑of‑bounds write that corrupts heap memory and can lead to a denial of service or limited memory corruption. The impact is confined to the process that performs ASF muxing of user‑supplied media.

Red Hat Enterprise Linux versions 7, 8, 9, and 10 that ship with the GStreamer 1.0 "bad‑free" plugin set, including the asfmux component, are affected. Any application running on these systems that uses the asfmux element to remux or transcode media to ASF format while preserving metadata can be impacted. The issue does not affect distributions lacking the asfmux plugin or those that have disabled it.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1 % shows that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the delivery of a specially crafted media file with crafted metadata tags containing non‑BMP Unicode characters to an application that performs ASF muxing. This can be a local processing job or a remote service that accepts media uploads. No public exploit code is known, and the probability of successful exploitation remains low under current conditions.