CVE-2026-121601: Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index

Q: Which systems should be prioritized for triage?

Prioritize applications that use the GStreamer gst-plugins-bad MXF demuxer to process MXF files supplied by users or other untrusted sources. The affected code is in mxfdemux.

Q: What does an attacker need to exploit this issue?

The attacker needs to provide a specially crafted MXF file and persuade a user to open it in an application that processes the file with the affected demuxer. No attacker privileges are required, but user interaction is required.

Q: Which upstream versions are affected and when was the issue fixed?

The vulnerable paths were introduced in GStreamer 1.20.0, so upstream versions 1.20.0 and later are affected. The upstream fix is in version 1.28.9, which was unreleased as of 2026-10-30.

Q: What can be done before an updated package is available?

Avoid opening MXF files from untrusted or unsolicited sources in applications that use the affected GStreamer plugin. This reduces the opportunity for an attacker to trigger the vulnerable parsing paths.

Published Nov 3, 2026

Updated

A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). ...

Other sources

gst-plugins-bad mxfdemux (gst/mxf/mxfdemux.c) contains at least five heap-buffer-overflow READ paths introduced in GStreamer 1.20.0 by the index-table refactor (commit ac483b2384, 2021-07-21). Root cause CWE-129: findeditentry() and findentryforoffset() use deltaid and slice as array indices without validating against ndeltaentries and slicecount.

Affected upstream GStreamer versions: >= 1.20.0, fixed in 1.28.9 (unreleased as of 2026-10-30). Upstream advisory SA-2026-0093; fix in gstreamer-security MR !131.

PSIRT ticket: PSIRTSUPT-29601.

Reporter: Sebastian Dröge, Centricular Ltd.

— Red Hat

Affected Software

5 affected componentsFixes available

GStreamer gst-plugins-bad>=1.20.0<1.28.9

debian/gst-plugins-bad1.0*

debian/gst-plugins-bad1.0<=1.22.0-4+deb12u7, <=1.22.0-4+deb12u8, <=1.26.2-3+deb13u3, <=1.28.8-1

1.28.9-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/gst-plugins-bad1.0 to a version that resolves this vulnerability.
Fixed in 1.28.9-1
Upgrade
Upgrade gstreamer1-plugins-bad-free to a version that resolves this vulnerability.
Fixed in 1.28.9

Event History

Nov 3, 2026

Data Sourced

via Red Hat·04:19 PM

DescriptionSeverityAffected Software

Nov 9, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·01:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems should be prioritized for triage?

Prioritize applications that use the GStreamer gst-plugins-bad MXF demuxer to process MXF files supplied by users or other untrusted sources. The affected code is in mxfdemux.

What does an attacker need to exploit this issue?

The attacker needs to provide a specially crafted MXF file and persuade a user to open it in an application that processes the file with the affected demuxer. No attacker privileges are required, but user interaction is required.

Which upstream versions are affected and when was the issue fixed?

The vulnerable paths were introduced in GStreamer 1.20.0, so upstream versions 1.20.0 and later are affected. The upstream fix is in version 1.28.9, which was unreleased as of 2026-10-30.

What can be done before an updated package is available?

Avoid opening MXF files from untrusted or unsolicited sources in applications that use the affected GStreamer plugin. This reduces the opportunity for an attacker to trigger the vulnerable parsing paths.

CVE-2026-121601: Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems should be prioritized for triage?

What does an attacker need to exploit this issue?

Which upstream versions are affected and when was the issue fixed?

What can be done before an updated package is available?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for triage?

What does an attacker need to exploit this issue?

Which upstream versions are affected and when was the issue fixed?

What can be done before an updated package is available?