Is CVE-2026-121601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121601 being exploited in the wild.

How severe is CVE-2026-121601?

Medium severity, with a CVSS score of 6.1, published 9 November 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad 1.22.x through 1.28.8.

Is there a fix for CVE-2026-121601?

No fixed version is recorded yet. Avoid parsing untrusted MXF content with the GStreamer MXF demuxer, or disable the mxfdemux plugin in applications that allow plugin selection. [{"kind":"disclosed","at":"2026-11-09"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-121601 attacked?

It is attacked with local access.

Am I affected by CVE-2026-121601?

Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121601: GStreamer MXF demuxer out-of-bounds read

CVE-2026-121601 · Severity: medium · CVSS 6.1 · Published 2026-11-09

GStreamer is a multimedia playback and processing framework used by media applications to decode and handle audio and video files. A flaw in its MXF demuxer plugin allows attackers to crash applications and potentially read sensitive memory by crafting malicious MXF media files. An attacker can trick a user into opening such a file, causing the application to crash or exposing data like cryptographic keys.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer.

Quick answers

Is CVE-2026-121601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121601 being exploited in the wild.
How severe is CVE-2026-121601?: Medium severity, with a CVSS score of 6.1, published 9 November 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad 1.22.x through 1.28.8.
Is there a fix for CVE-2026-121601?: No fixed version is recorded yet. Avoid parsing untrusted MXF content with the GStreamer MXF demuxer, or disable the mxfdemux plugin in applications that allow plugin selection.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-09"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121601 attacked?: It is attacked with local access.
Am I affected by CVE-2026-121601?: Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Avoid parsing untrusted MXF content with the GStreamer MXF demuxer, or disable the mxfdemux plugin in applications that allow plugin selection.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-09"}]

Technical details

The MXF demuxer in gst-plugins-bad performs out-of-bounds reads (CWE-125) when indexing delta-entry and slice-offset tables using unchecked values from the MXF file. The vulnerability requires local user interaction (file open) with no privileges required. Exploitation results in denial of service (application crash) and limited heap memory disclosure, without code execution capability.

Affected products

GStreamer gst-plugins-bad 1.22.x through 1.28.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.