DEBIAN-CVE-2026-125707: Medium severity debian/gst-plugins-bad1.0 vulnerability

Q: Who is exposed to this issue?

Applications using Debian's gst-plugins-bad1.0 package that process MXF files are exposed. Exploitation requires the application to handle a crafted MXF file.

Q: Does exploitation require prior access or user interaction?

The supplied severity vector indicates no privileges are required, but user interaction is required. An attacker would need to cause the application to process a crafted MXF file.

Q: What is the expected impact?

The flaw permits a one-byte write beyond the logical end of a temporal offset array, which may corrupt memory and crash the application. The extent of impact beyond a crash has not been demonstrated by a runtime test.

Published Nov 10, 2026

Updated

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.

Affected Software

3 affected componentsFixes available

debian/gst-plugins-bad1.0*

debian/gst-plugins-bad1.0<1.28.3-1

1.28.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/gst-plugins-bad1.0 to a version that resolves this vulnerability.
Fixed in 1.28.3-1

Event History

Nov 10, 2026

CVE Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using Debian's gst-plugins-bad1.0 package that process MXF files are exposed. Exploitation requires the application to handle a crafted MXF file.

Does exploitation require prior access or user interaction?

The supplied severity vector indicates no privileges are required, but user interaction is required. An attacker would need to cause the application to process a crafted MXF file.

What is the expected impact?

The flaw permits a one-byte write beyond the logical end of a temporal offset array, which may corrupt memory and crash the application. The extent of impact beyond a crash has not been demonstrated by a runtime test.

DEBIAN-CVE-2026-125707: Medium severity debian/gst-plugins-bad1.0 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require prior access or user interaction?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require prior access or user interaction?

What is the expected impact?