CVE-2026-125707
Awaiting Analysis Awaiting Analysis - Queue

GStreamer MXF Demuxer Off-by-One Memory Corruption

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: redhat-SADP

Description
A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125707
EUVD
EUVD-2026-120883

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an off-by-one bounds check error in GStreamer's MXF demuxer. When processing a crafted MXF file, it allows a one-byte write past the end of a temporal offset array, potentially corrupting memory and causing the application to crash. The flaw stems from incorrect validation using a greater-than comparison instead of greater-than-or-equal-to.

Detection Guidance

To detect this vulnerability, check the version of gst-plugins-bad installed on your system. Run: gst-inspect-1.0 --version. If the version is below 1.28.3, the system is vulnerable. Additionally, monitor for crashes or memory corruption when processing MXF files.

Impact Analysis

The impact includes application crashes, denial of service, or potential information disclosure if sensitive memory is exposed. Exploitation requires a user or service to process a malicious file, but no special privileges or race conditions are needed. Memory corruption could also lead to arbitrary code execution in some cases.

Mitigation Strategies

Disable the MXF demuxer plugin by setting the environment variable GST_REGISTRY_FORK=no before processing untrusted MXF files. Alternatively, upgrade gst-plugins-bad to version 1.28.3 or later. For RHEL systems, apply patches or upgrade to RHEL 10.4 or RHIVOS 2.1.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125707. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...