UBUNTU-CVE-2026-125707: Medium severity ubuntu/gst-plugins-bad1.0 vulnerability
Published Nov 12, 2026
·Updated
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.
Affected Software
7 affected components
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
ubuntu/gst-plugins-bad1.0*
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker provide to trigger this issue?
An application using the affected GStreamer MXF demuxer must process a crafted MXF file. The issue is triggered during handling of that malicious media input.
2
What is the known impact?
The off-by-one bounds check can write one byte past the logical end of a temporal offset array, potentially corrupting memory and causing the application to crash. Runtime testing has not demonstrated the full extent of the impact.