CVE-2026-121601
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
| CWE | CWE-125 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new medium vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 6
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected