Bug 2565920 (CVE-2026-121601)

Summary:	CVE-2026-121601 gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: Out-of-bounds read in mxfdemux via unchecked delta_id and slice index
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2569075, 2569076, 2569077, 2569078, 2569079, 2569080, 2569086, 2569087
Bug Blocks:

Description OSIDB Bzimport 2026-11-03 16:19:06 UTC

gst-plugins-bad mxfdemux (gst/mxf/mxfdemux.c) contains at least five heap-buffer-overflow READ paths introduced in GStreamer 1.20.0 by the index-table refactor (commit ac483b2384, 2021-07-21). Root cause CWE-129: find_edit_entry() and find_entry_for_offset() use delta_id and slice as array indices without validating against n_delta_entries and slice_count.

Affected upstream GStreamer versions: >= 1.20.0, fixed in 1.28.9 (unreleased as of 2026-10-30). Upstream advisory SA-2026-0093; fix in gstreamer-security MR !131.

PSIRT ticket: PSIRTSUPT-29601.

Reporter: Sebastian Dröge, Centricular Ltd.