REDHAT-BUG-2569129: Medium severity GStreamer gst-plugins-bad vulnerability

Q: Which deployments are exposed to this issue?

Deployments that use the GStreamer MXF demuxer or muxer to process MXF content are relevant. The risk is associated with handling crafted MXF input.

Q: What is the available remediation?

Update gst-plugins-bad to version 1.28.3, which contains the fix.

Published Nov 9, 2026

Updated

GStreamer-SA-2026-0029: Incorrect or insufficient bounds checks in MXF VANC packet handling affect the demuxer and muxer. Crafted MXF content may trigger unchecked bit/byte reader accesses, invalid array handling, or incorrect packet and wrapper sizes, potentially causing crashes, data corruption, or denial of service. Fixed in gst-plugins-bad 1.28.3.

Affected Software

1 affected component

GStreamer gst-plugins-bad<1.28.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gst-plugins-bad to a version that resolves this vulnerability.
Fixed in 1.28.3Patch GStreamer-SA-2026-0029

Event History

Nov 9, 2026

Data Sourced

via Red Hat·12:56 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments that use the GStreamer MXF demuxer or muxer to process MXF content are relevant. The risk is associated with handling crafted MXF input.

What is the available remediation?

Update gst-plugins-bad to version 1.28.3, which contains the fix.