CVE-2026-125703: Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.
Other sources
GStreamer-SA-2026-0029: Incorrect or insufficient bounds checks in MXF VANC packet handling affect the demuxer and muxer. Crafted MXF content may trigger unchecked bit/byte reader accesses, invalid array handling, or incorrect packet and wrapper sizes, potentially causing crashes, data corruption, or denial of service. Fixed in gst-plugins-bad 1.28.3.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.3Patch GStreamer-SA-2026-0029
Event History
Frequently Asked Questions
What must an attacker do to trigger this issue?
An attacker must cause an application using the affected MXF plugin to process crafted MXF content containing malformed VANC data. Exploitation requires user interaction, as reflected by the UI:R vector.
Who is exposed to this vulnerability?
Applications that use the GStreamer gst-plugins-bad MXF demuxer or muxer and process untrusted or attacker-supplied MXF content are exposed. The documented impact is an application crash and denial of service.
What happens when the flaw is triggered?
Malformed VANC data can cause an out-of-bounds read during demuxing, and muxing multiple ancillary packets can cause an out-of-bounds write because of an incorrect buffer size calculation. Both conditions may crash the affected application.