{"id":"CVE-2026-121601","published":"2026-11-09T13:17:06.910","lastModified":"2026-11-09T17:17:15.133","description":"A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-121601","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565920","tags":[]},{"url":"https://gstreamer.freedesktop.org/security/sa-2026-0093.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}