DEBIAN-CVE-2026-125703: Medium severity debian/gst-plugins-bad1.0 vulnerability
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gst-plugins-bad1.0to a version that resolves this vulnerability.Fixed in 1.28.3-1
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker would need to cause an application using the affected MXF plugin to process crafted VANC data or to mux multiple crafted ancillary packets. The vulnerability requires user interaction and is locally exploitable according to the provided vector.
What is the likely impact of successful exploitation?
Processing the affected content can cause an out-of-bounds read in the demuxer or an out-of-bounds write during muxing. The stated impact is an application crash and denial of service; no confidentiality or integrity impact is identified.
Which component should be prioritized for review?
Review systems using Debian's gst-plugins-bad1.0 package, specifically workloads that use the GStreamer MXF plugin to demux VANC-containing content or mux multiple ancillary packets.