Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-121601 EUVD-2026-120051GHSA-pwwr-87p6-hjj7

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index

Published Nov 9, 2026 · Updated Nov 9, 2026 · Assigned by redhat

Description

A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gst-plugins-bad1.0 1.28.9-1 —
Debian 13 gst-plugins-bad1.0 No fix yet —
Debian 12 gst-plugins-bad1.0 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gst-plugins-bad1.0 No fix yet —
Ubuntu 26.04 LTS gst-plugins-bad1.0 No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS gst-plugins-bad1.0 No fix yet —
Ubuntu Pro 22.04 LTS gst-plugins-bad1.0 No fix yet —
Ubuntu Pro 20.04 LTS gst-plugins-bad1.0 No fix yet —
Ubuntu Pro 18.04 LTS gst-plugins-bad1.0 No fix yet —
Ubuntu Pro 16.04 LTS gst-plugins-bad1.0 No fix yet —
Ubuntu Pro 14.04 LTS gst-plugins-bad1.0 No fix yet —

Advisories 1

References