What happened
A vulnerability has been identified in the GStreamer multimedia framework’s ASF muxer plugin (asfmux). This flaw occurs when writing string metadata tags that contain Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container. The plugin miscalculates the buffer size needed for UTF-16LE encoding, assuming each Unicode code point requires 2 bytes. However, characters outside the BMP require 4 bytes due to surrogate pairs. This miscalculation results in a heap out-of-bounds write during the UTF-16LE conversion process.
This issue can be exploited when affected applications transcode or remux media to ASF format while retaining metadata. An attacker with local access can leverage this flaw by providing media containing crafted metadata tags, potentially causing a denial of service or limited memory corruption. The attack requires no prior access beyond the ability to run the application, and successful exploitation demands user interaction, such as opening a malicious file or visiting a compromised page.
Who is affected
Organisations running versions of Red Hat Enterprise Linux 10, 7, 8, or 9 that include the GStreamer framework with the asfmux plugin are affected. This vulnerability impacts any affected deployment where the GStreamer multimedia framework is used for transcoding or remuxing media files, particularly in workflows that handle metadata containing non-BMP Unicode characters. It requires local access, with no need for remote network access to be exploited.
Recommended actions
Limit access to affected systems to authorised users to prevent unauthorised local access.
Monitor for signs of manipulative media files or unexpected application behaviour which may indicate attempts to exploit this vulnerability.
Apply available security updates or mitigations provided by the vendor as they become available to address the flaw.
Implement control measures to enforce privilege hygiene and restrict untrusted media input handling in applications using the GStreamer framework.
