# CVE-2026-125707: GStreamer MXF demuxer off-by-one buffer write

Source: https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125707 · Severity: medium · CVSS 6.1 · Published 2026-11-10

GStreamer is a multimedia framework used by many applications to process audio and video files. A flaw in its MXF (Material eXchange Format) file parser allows a crafted file to write one byte past the intended boundary of an array, corrupting memory and crashing the application. While a demonstration of more severe impact has not been confirmed, this vulnerability could potentially enable code execution depending on the memory layout.

Technologies: [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-125707 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125707 being exploited in the wild.

**How severe is CVE-2026-125707?** Medium severity, with a CVSS score of 6.1, published 10 November 2026.

**Which products and versions are affected?** GStreamer GStreamer.

**Is there a fix for CVE-2026-125707?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125707 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-125707?** Check whether you run Gstreamer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one bounds check error in the MXF demuxer allows a one-byte write past the logical end of a temporal offset array when processing a specially crafted MXF file. This buffer overflow corrupts adjacent memory and causes the application to crash. The vulnerability requires the application to process a malicious MXF file, with no authentication or user privilege elevation required beyond opening the file.

## Affected products

- GStreamer GStreamer

## Timeline

- 2026-11-10: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://gitlab.freedesktop.org/gstreamer/gstreamer](https://gitlab.freedesktop.org/gstreamer/gstreamer)

## Related threats

- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)
- [GStreamer gst-plugins-good heap buffer overflow in GdkPixbuf decoder](https://junglewise.ai/threats/cve-2026-18298-gstreamer-gst-plugins-good-heap-buffer-overflow-in-gdkpixbuf)