# CVE-2026-121601: GStreamer MXF demuxer out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-121601-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-plugin-gst-plugins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-121601 · Severity: medium · CVSS 6.1 · Published 2026-11-09

GStreamer is a multimedia playback and processing framework used by media applications to decode and handle audio and video files. A flaw in its MXF demuxer plugin allows attackers to crash applications and potentially read sensitive memory by crafting malicious MXF media files. An attacker can trick a user into opening such a file, causing the application to crash or exposing data like cryptographic keys.

Technologies: [Gstreamer Gst-Plugins-Bad](https://junglewise.ai/threats/technologies/gst-plugins-bad). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-121601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121601 being exploited in the wild.

**How severe is CVE-2026-121601?** Medium severity, with a CVSS score of 6.1, published 9 November 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Bad 1.22.x through 1.28.8.

**Is there a fix for CVE-2026-121601?** No fixed version is recorded yet. Avoid parsing untrusted MXF content with the GStreamer MXF demuxer, or disable the mxfdemux plugin in applications that allow plugin selection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-09"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121601 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-121601?** Check whether you run Gstreamer Gst-Plugins-Bad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Avoid parsing untrusted MXF content with the GStreamer MXF demuxer, or disable the mxfdemux plugin in applications that allow plugin selection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-09"}]

## Technical details

The MXF demuxer in gst-plugins-bad performs out-of-bounds reads (CWE-125) when indexing delta-entry and slice-offset tables using unchecked values from the MXF file. The vulnerability requires local user interaction (file open) with no privileges required. Exploitation results in denial of service (application crash) and limited heap memory disclosure, without code execution capability.

## Affected products

- GStreamer gst-plugins-bad 1.22.x through 1.28.8

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-121601](https://access.redhat.com/security/cve/CVE-2026-121601)

## Related threats

- [GStreamer gst-plugins-bad out-of-bounds read in MPEG/DVD parsing](https://junglewise.ai/threats/cve-2026-125706-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-mpeg-program)
- [GStreamer gst-plugins-bad MXF plugin buffer overflow in VANC handling](https://junglewise.ai/threats/cve-2026-125703-a-flaw-was-found-in-the-gstreamer-gst-plugins-bad-mxf-plugin)
- [GStreamer gst-plugins-bad H.265 uninitialized memory use](https://junglewise.ai/threats/cve-2026-121611-a-flaw-was-found-in-gstreamer-s-gst-plugins-bad-package-a-use-of)
- [GStreamer gst-plugins-bad JPEG 2000 decimator integer overflow and division by zero](https://junglewise.ai/threats/cve-2026-121259-a-flaw-was-found-in-the-gstreamer-jpeg-2000-decimator-in-gst)
- [GStreamer gst-plugins-bad NULL pointer dereference in H.264 MVC parser](https://junglewise.ai/threats/cve-2026-119728-a-flaw-was-found-in-the-h-264-video-parser-in-gst-plugins-bad)