CVE-2026-125707: Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.
Other sources
GStreamer-SA-2026-0027 (CVE-2026-XXXX pending): An off-by-one bounds check in mxfdemux uses a greater-than comparison instead of greater-than-or-equal when validating array access for reverse temporal offsets. A crafted MXF file can cause a one-element out-of-bounds read, potentially resulting in a crash, denial of service, or information disclosure. Fixed in gst-plugins-bad 1.28.3.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.3
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The vulnerability is rated with local attack vector and requires user interaction. No privileges are required, but an application must process a crafted MXF file.
What impact has been confirmed so far?
The one-byte out-of-bounds write may corrupt memory and cause the affected application to crash. The broader impact has not been demonstrated by a runtime test.