REDHAT-BUG-2565920: Medium severity GStreamer gst-plugins-bad vulnerability
Published Nov 3, 2026
·Updated
gst-plugins-bad mxfdemux (gst/mxf/mxfdemux.c) contains at least five heap-buffer-overflow READ paths introduced in GStreamer 1.20.0 by the index-table refactor (commit ac483b2384, 2021-07-21). Root cause CWE-129: findeditentry() and findentryforoffset() use deltaid and slice as array indices without validating against ndeltaentries and slicecount.
Affected upstream GStreamer versions: >= 1.20.0, fixed in 1.28.9 (unreleased as of 2026-10-30). Upstream advisory SA-2026-0093; fix in gstreamer-security MR !131.
PSIRT ticket: PSIRTSUPT-29601.
Reporter: Sebastian Dröge, Centricular Ltd.
Affected Software
1 affected component
GStreamer gst-plugins-bad>=1.20.0<1.28.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamerto a version that resolves this vulnerability.Fixed in 1.28.9Patch SA-2026-0093
Event History
Nov 3, 2026
Data Sourced
via Red Hat·04:19 PM
DescriptionSeverityAffected Software