The flaw originates in the ASF demuxer of gst-plugins-ugly. When parsing a Simple Index object, the demuxer uses an attacker‑controlled entry count to determine the size of a heap allocation without bounding it against the actual payload size. A crafted ASF, WMV, or WMA file can therefore trigger an excessively large memory allocation request, causing the process to exhaust memory or fail to allocate and crash, which results in a denial of service. The vulnerability is an uncontrolled memory allocation, identified as CWE‑789. It does not provide remote code execution or other higher‑level attacks; the impact is limited to service interruption through memory exhaustion. The CVSS score of 6.5 marks the flaw as moderately severe. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalogue. The attack vector is likely local or remote through any GStreamer‑based application that accepts user supplied files, such as media players, indexers, or thumbnailers. Exploiting the flaw requires supplying a crafted file containing a Simple Index object; it does not require elevated privileges or network access beyond the ability to load the file.

The affected products are Red Hat Enterprise Linux releases 7, 8, 9, and 10. Any system running the unpatched gstreamer‑plugins‑ugly package on these operating systems is vulnerable, regardless of the distribution channel. No specific patch version information is provided in the data, but the vulnerability is known to affect the default gstreamer‑plugins‑ugly package distributed with these Red Hat releases. Administrators should inspect the installation of gstreamer‑plugins‑ugly on each of the affected RHEL deployments and apply the latest available security update.

Given its moderate CVSS score and lack of an EPSS value, the likelihood of widespread exploitation appears limited, yet the denial of service can disrupt media processing services and end‑user experiences. The flaw is not currently in the KEV list, suggesting no confirmed active exploitation. To mitigate risks, promptly apply the vendor patch, and as an interim control, restrict the processing of ASF, WMV, or WMA files from untrusted sources in applications that use GStreamer.