{"id":"CVE-2026-125703","kind":"vulnerability","aliases":["CVE-2026-125703"],"related":[],"title":"GStreamer MXF plugin: crafted VANC data crashes apps via out-of-bounds access","description":"A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.","summary":"The GStreamer gst-plugins-bad MXF plugin does not check bounds when parsing VANC ancillary data, causing out-of-bounds reads and writes. Processing a crafted MXF file may crash the application, a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-bad","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gstreamer","media-processing","mxf","package"],"not_affected_if":["no-mxf-processing"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:22:05+00:00","updated_at":"2026-11-10T11:22:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T11:22:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer MXF plugin: crafted VANC data crashes apps via out-of-bounds access","impact":"low","summary":"The GStreamer gst-plugins-bad MXF plugin does not check bounds when parsing VANC ancillary data, causing out-of-bounds reads and writes. Processing a crafted MXF file may crash the application, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","media-processing","mxf"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes while processing crafted MXF content, denial of service","analyst_note":"Find affected and fixed gst-plugins-bad versions in the NVD entry or upstream GStreamer advisory.","how_to_check":"unknown","plain_action":"","product_name":"gst-plugins-bad","needs_analyst":true,"not_affected_if":["no-mxf-processing"],"who_is_affected":"Applications that use the GStreamer gst-plugins-bad MXF demuxer or muxer to process MXF media files, especially ones that accept untrusted uploads. Systems that never parse MXF content are not exposed. The sources do not name affected versions.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4574,"output_tokens":494,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125703':17A,20A '-2026':16A,19A 'access':14A 'affect':121C 'ancillari':46B,110C 'app':8A 'applic':64B,126C 'bad':24A,36B,79C 'bound':13A,42B,52B,83C,96C,118C 'buffer':104C 'calcul':106C 'caus':48B,91C,113C 'check':41B,84C 'content':122C 'craft':4A,58B,87C 'crash':7A,62B,124C 'cve':15A,18A 'data':6A,47B,89C 'demux':100C 'denial':66B,130C 'file':60B 'flaw':70C 'found':72C 'gst':22A,34B,77C 'gst-plugins-bad':21A,33B,76C 'gstreamer':1A,25B,32B,75C 'incorrect':103C 'insuffici':82C 'may':61B,123C 'media':27B 'media-process':26B 'multipl':109C 'mux':108C 'mxf':2A,29B,37B,59B,80C 'out-of-bound':10A,49B,93C,115C 'packag':30B 'packet':111C 'pars':44B,86C 'plugin':3A,35B,38B,78C,81C 'plugins':23A 'process':28B,56B,120C 'read':53B,97C 'result':127C 'servic':68B,132C 'size':105C 'vanc':5A,45B,88C 'via':9A 'write':55B,119C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the GStreamer gst-plugins-bad MXF demuxer or muxer to process MXF media files, especially ones that accept untrusted uploads. Systems that never parse MXF content are not exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["gstpluginsbad"],"ptokens":["bad","gst","plugins"],"labels":["gstreamer","mediaprocessing","medium","mxf","package","vendor"],"campaign_type":null,"search_a":"'-125703':17A,20A '-2026':16A,19A 'access':14A 'app':8A 'bad':24A 'bound':13A 'craft':4A 'crash':7A 'cve':15A,18A 'data':6A 'gst':22A 'gst-plugins-bad':21A 'gstreamer':1A 'mxf':2A 'out-of-bound':10A 'plugin':3A 'plugins':23A 'vanc':5A 'via':9A","search_b":"'ancillari':46B 'applic':64B 'bad':36B 'bound':42B,52B 'caus':48B 'check':41B 'craft':58B 'crash':62B 'data':47B 'denial':66B 'file':60B 'gst':34B 'gst-plugins-bad':33B 'gstreamer':25B,32B 'may':61B 'media':27B 'media-process':26B 'mxf':29B,37B,59B 'out-of-bound':49B 'packag':30B 'pars':44B 'plugin':35B,38B 'process':28B,56B 'read':53B 'servic':68B 'vanc':45B 'write':55B","search_c":"'affect':121C 'ancillari':110C 'applic':126C 'bad':79C 'bound':83C,96C,118C 'buffer':104C 'calcul':106C 'caus':91C,113C 'check':84C 'content':122C 'craft':87C 'crash':124C 'data':89C 'demux':100C 'denial':130C 'flaw':70C 'found':72C 'gst':77C 'gst-plugins-bad':76C 'gstreamer':75C 'incorrect':103C 'insuffici':82C 'may':123C 'multipl':109C 'mux':108C 'mxf':80C 'out-of-bound':93C,115C 'packet':111C 'pars':86C 'plugin':78C,81C 'process':120C 'read':97C 'result':127C 'servic':132C 'size':105C 'vanc':88C 'write':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T11:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125703","severity":null,"published_at":"2026-11-10T11:16:43+00:00","modified_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}