{"id":"CVE-2026-121601","kind":"vulnerability","aliases":["CVE-2026-121601"],"related":[],"title":"GStreamer: crafted MXF file can crash apps and leak heap memory","description":"A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.","summary":"GStreamer's MXF demuxer in gst-plugins-bad indexes internal tables with unchecked values from the file. A crafted MXF media file can crash the application or let an attacker read limited heap memory next to those arrays.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gst-plugins-bad","gstreamer","media-playback","package"],"not_affected_if":["no-mxf-parsing","plugin-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:39+00:00","updated_at":"2026-11-09T13:27:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T13:27:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GStreamer: crafted MXF file can crash apps and leak heap memory","impact":"medium","summary":"GStreamer's MXF demuxer in gst-plugins-bad indexes internal tables with unchecked values from the file. A crafted MXF media file can crash the application or let an attacker read limited heap memory next to those arrays.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","gst-plugins-bad","media-playback"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes; limited heap memory may be read","analyst_note":"Find affected and fixed gst-plugins-bad versions in the GStreamer advisory or NVD configuration data; the source here names no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-mxf-parsing","plugin-not-installed"],"who_is_affected":"Applications that use GStreamer's gst-plugins-bad MXF demuxer to open media files, especially ones that accept untrusted MXF input. Systems that never parse MXF files, or that run without this plugin, are unlikely to be exposed. The sources do not name affected versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4612,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121601':14A,17A '-2026':13A,16A 'abl':143C 'adjac':151C 'affect':154C 'alloc':116C 'amount':147C 'app':7A 'applic':53B,134C 'array':65B,117C,155C 'attack':57B,120C 'bad':21B,35B,79C 'bound':113C 'caus':132C 'craft':2A,46B,84C 'crash':6A,51B,136C 'cve':12A,15A 'delta':94C 'delta-entri':93C 'demux':30B,74C,89C 'denial':137C 'entri':95C 'file':4A,44B,49B,87C,105C,130C 'flaw':67C 'found':69C 'gst':19B,33B,77C 'gst-plugins-bad':18B,32B,76C 'gstreamer':1A,22B,27B,71C 'heap':10A,60B,149C 'index':36B,90C 'intern':37B,92C 'leak':9A 'let':55B 'limit':59B,146C 'local':119C 'malici':128C 'may':141C 'media':24B,48B,86C 'media-playback':23B 'memori':11A,61B,150C 'mxf':3A,29B,47B,73C,85C,129C 'next':62B 'offset':99C 'open':126C 'packag':26B 'playback':25B 'plugin':20B,34B,75C,78C 'process':81C 'read':58B,145C 'servic':139C 'slice':98C 'slice-offset':97C 'special':83C 'tabl':38B,100C 'trick':122C 'uncheck':40B 'use':101C 'user':124C 'valid':107C 'valu':41B,102C 'within':111C 'without':106C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer's gst-plugins-bad MXF demuxer to open media files, especially ones that accept untrusted MXF input. Systems that never parse MXF files, or that run without this plugin, are unlikely to be exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstpluginsbad","gstreamer","mediaplayback","medium","package"],"campaign_type":null,"search_a":"'-121601':14A,17A '-2026':13A,16A 'app':7A 'craft':2A 'crash':6A 'cve':12A,15A 'file':4A 'gstreamer':1A 'heap':10A 'leak':9A 'memori':11A 'mxf':3A","search_b":"'applic':53B 'array':65B 'attack':57B 'bad':21B,35B 'craft':46B 'crash':51B 'demux':30B 'file':44B,49B 'gst':19B,33B 'gst-plugins-bad':18B,32B 'gstreamer':22B,27B 'heap':60B 'index':36B 'intern':37B 'let':55B 'limit':59B 'media':24B,48B 'media-playback':23B 'memori':61B 'mxf':29B,47B 'next':62B 'packag':26B 'playback':25B 'plugin':20B,34B 'read':58B 'tabl':38B 'uncheck':40B 'valu':41B","search_c":"'abl':143C 'adjac':151C 'affect':154C 'alloc':116C 'amount':147C 'applic':134C 'array':117C,155C 'attack':120C 'bad':79C 'bound':113C 'caus':132C 'craft':84C 'crash':136C 'delta':94C 'delta-entri':93C 'demux':74C,89C 'denial':137C 'entri':95C 'file':87C,105C,130C 'flaw':67C 'found':69C 'gst':77C 'gst-plugins-bad':76C 'gstreamer':71C 'heap':149C 'index':90C 'intern':92C 'limit':146C 'local':119C 'malici':128C 'may':141C 'media':86C 'memori':150C 'mxf':73C,85C,129C 'offset':99C 'open':126C 'plugin':75C,78C 'process':81C 'read':145C 'servic':139C 'slice':98C 'slice-offset':97C 'special':83C 'tabl':100C 'trick':122C 'use':101C 'user':124C 'valid':107C 'valu':102C 'within':111C 'without':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121601","severity":null,"published_at":"2026-11-09T13:17:06+00:00","modified_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}