Denial of Service Vulnerability in GStreamer MXF Demuxer Plugin
CVE-2026-121601

6.1MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
9 November 2026

What is CVE-2026-121601?

A vulnerability exists in the GStreamer MXF demuxer plugin, allowing local attackers to exploit the handling of specially crafted MXF media files. The plugin fails to properly validate values used for indexing its internal data structures, leading to potential application crashes. In some cases, this flaw could allow an attacker to read portions of adjacent heap memory, raising significant security concerns for users who unknowingly open these malicious files.

References

https://access.redhat.com/security/cve/CVE-2026-121601
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2565920
issue-trackingx_refsource_REDHAT
https://gstreamer.freedesktop.org/security/sa-2026-0093.html

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.