CVE-2026-121601 · Package
NO FIX YET
GStreamer's MXF demuxer in gst-plugins-bad indexes internal tables with unchecked values from the file. A crafted MXF media file can crash the application or let an attacker read limited heap memory next to those arrays.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use GStreamer's gst-plugins-bad MXF demuxer to open media files, especially ones that accept untrusted MXF input. Systems that never parse MXF files, or that run without this plugin, are unlikely to be exposed. The sources do not name affected versions.
Not affected if no-mxf-parsing, plugin-not-installed
Who cares gst-plugins-bad, gstreamer, media-playback
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.