Bug 2569391

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer-SA-2026-0027: In gst-plugins-bad's mxfdemux, the bound check for an index into the reverse temporal offset GArray uses > where >= is required. A crafted MXF Index Table Segment can supply a temporal offset that makes the computed index equal to the array's length; the following g_array_index assignment then writes one signed byte past the array's logical end. Static comparison of GStreamer 1.28.2 and 1.28.3 found that the fix changes this comparison to >=. The public advisory describes an out-of-bounds read, but the affected operation is a write. No build or PoC was run, so crossing the allocated capacity and a resulting crash were not demonstrated. The advisory states gst-plugins-bad versions before 1.28.3 are affected; 1.28.3 contains the fix. Reporter attribution is not available in the public advisory.