{"id":"CVE-2026-125707","kind":"vulnerability","aliases":["CVE-2026-125707"],"related":[],"title":"GStreamer: crafted MXF file can cause a one-byte memory write","description":"A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.","summary":"GStreamer's MXF demuxer has an off-by-one bounds check that lets a crafted MXF media file write one byte past the end of an array. The write can corrupt memory and crash the application that opens the file.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gstreamer","media-processing","mxf","package"],"not_affected_if":["no-untrusted-mxf-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:41+00:00","updated_at":"2026-11-10T12:22:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T12:22:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GStreamer: crafted MXF file can cause a one-byte memory write","impact":"medium","summary":"GStreamer's MXF demuxer has an off-by-one bounds check that lets a crafted MXF media file write one byte past the end of an array. The write can corrupt memory and crash the application that opens the file.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","media-processing","mxf"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"memory corruption and application crash from a crafted file","analyst_note":"Find the affected GStreamer version range and fixed release in the NVD entry or upstream GStreamer advisory; the sources do not state them.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-mxf-input"],"who_is_affected":"Applications that use GStreamer to parse MXF files, such as media players, transcoders and ingest pipelines, are exposed when they process untrusted MXF input. Applications that never open MXF files from outside sources can skip it. The sources do not give affected versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4543,"output_tokens":451,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125707':15A,18A '-2026':14A,17A 'allow':91C 'applic':61B,77C,113C 'array':52B,105C 'bound':35B,88C 'byte':10A,46B,95C 'caus':6A,111C 'check':36B,89C 'corrupt':56B,108C 'craft':2A,40B,80C 'crash':59B,115C 'cve':13A,16A 'demonstr':124C 'demux':28B,74C 'end':49B,100C 'extent':117C 'file':4A,43B,65B,82C 'flaw':67C 'found':69C 'gstreamer':1A,19B,25B,71C 'impact':120C 'let':38B 'logic':99C 'may':107C 'media':21B,42B 'media-process':20B 'memori':11A,57B,109C 'mxf':3A,23B,27B,41B,73C,81C 'off-by-on':31B,84C 'offset':104C 'one':9A,34B,45B,87C,94C 'one-byt':8A,93C 'open':63B 'packag':24B 'past':47B,97C 'process':22B,78C 'runtim':127C 'tempor':103C 'test':128C 'write':12A,44B,54B,96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use GStreamer to parse MXF files, such as media players, transcoders and ingest pipelines, are exposed when they process untrusted MXF input. Applications that never open MXF files from outside sources can skip it. The sources do not give affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gstreamer","mediaprocessing","medium","mxf","package"],"campaign_type":null,"search_a":"'-125707':15A,18A '-2026':14A,17A 'byte':10A 'caus':6A 'craft':2A 'cve':13A,16A 'file':4A 'gstreamer':1A 'memori':11A 'mxf':3A 'one':9A 'one-byt':8A 'write':12A","search_b":"'applic':61B 'array':52B 'bound':35B 'byte':46B 'check':36B 'corrupt':56B 'craft':40B 'crash':59B 'demux':28B 'end':49B 'file':43B,65B 'gstreamer':19B,25B 'let':38B 'media':21B,42B 'media-process':20B 'memori':57B 'mxf':23B,27B,41B 'off-by-on':31B 'one':34B,45B 'open':63B 'packag':24B 'past':47B 'process':22B 'write':44B,54B","search_c":"'allow':91C 'applic':77C,113C 'array':105C 'bound':88C 'byte':95C 'caus':111C 'check':89C 'corrupt':108C 'craft':80C 'crash':115C 'demonstr':124C 'demux':74C 'end':100C 'extent':117C 'file':82C 'flaw':67C 'found':69C 'gstreamer':71C 'impact':120C 'logic':99C 'may':107C 'memori':109C 'mxf':73C,81C 'off-by-on':84C 'offset':104C 'one':87C,94C 'one-byt':93C 'past':97C 'process':78C 'runtim':127C 'tempor':103C 'test':128C 'write':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125707","severity":null,"published_at":"2026-11-10T12:17:18+00:00","modified_at":"2026-11-10T12:17:18+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}