CVE-2026-121601
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
What each source reports
CVE List Score used
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
- Record
CVE-2026-121601- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-09
EUVDEUVD-2026-120051
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
- Record
EUVD-2026-120051- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-pwwr-87p6-hjj7
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially...
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
- Record
GHSA-pwwr-87p6-hjj7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-09
NVD
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
- Record
CVE-2026-121601- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-09
OSVDEBIAN-CVE-2026-121601
- Record
DEBIAN-CVE-2026-121601- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-09
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-bad1.0Debian:12 |
All versions, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u4 Show 45 moreShow less1.22.0-4+deb12u51.22.0-4+deb12u61.22.0-4+deb12u71.22.0-4+deb12u81.22.1-11.22.10-11.22.3-11.22.3-21.22.4-11.22.7-11.22.8-11.22.9-11.22.9-21.23.1-11.23.2-11.23.90-11.24.0-11.24.1-11.24.1-21.24.1-31.24.1-41.24.10-11.24.10-21.24.10-2+hurd.11.24.10-31.24.11-11.24.11-21.24.11-31.24.12-11.24.12-21.24.12-31.24.2-11.24.2-21.24.2-31.24.2-41.24.3-11.24.4-11.24.4-21.24.5-11.24.6-11.24.7-11.24.8-11.24.8-21.24.9-11.25.1-1 |
None known |
gst-plugins-bad1.0Debian:13 |
All versions, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.2-3+deb13u11.26.2-3+deb13u2 Show 38 moreShow less1.26.2-3+deb13u31.26.3-11.26.4-11.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.28.9-11.29.1-11.29.2-11.29.2-2 |
None known |
gst-plugins-bad1.0Debian:14 |
All versions, plus listed versions 1.26.10-11.26.10-21.26.2-31.26.3-11.26.4-1 Show 35 moreShow less1.26.5-11.26.5-21.26.6-11.26.6-21.26.6-31.26.6-41.26.6-51.26.7-11.26.7-21.26.8-11.26.9-11.27.1-11.27.2-11.27.50-11.27.90-11.27.90-21.27.90-31.28.0-11.28.1-11.28.1-21.28.1-31.28.2-11.28.2-21.28.3-11.28.4-11.28.5-11.28.5-21.28.6-11.28.7-11.28.7-21.28.8-11.28.9-11.29.1-11.29.2-11.29.2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | NVD, OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-121601 is a medium vulnerability (CVSS 6.1) in Red Hat Enterprise Linux 10, published November 9, 2026. No source lists public exploit code. No source names a fixed version.
References
Left out here: 50 versions. The JSON record has them.