Security Advisory 2026-0031 (CVE-2026-XXXX)
|
|
| Summary |
Integer overflow and truncation in MXF demuxer |
| Date |
2026-06-12 |
| Affected Versions |
GStreamer gst-plugins-bad < 1.28.4 |
| IDs |
GStreamer-SA-2026-0031
CVE-2026-XXXX |
Details
Integer overflow and truncation vulnerabilities in the mxfdemux element (MXF demuxer) in gst-plugins-bad when handling malformed MXF files. The demuxer incorrectly uses signed integers for position and offset tracking throughout the index table lookup and seeking logic, which can underflow during backward searches and wrap to large positive values. Additionally, 64-bit integer values are truncated when stored in 32-bit signed types, and duration boundary checks fail to account for sentinel values, allowing out-of-bounds array access and infinite loops.
Impact
A malicious third party could trigger an out-of-bounds read that can crash the application, resulting in denial of service or information disclosure when processing crafted MXF media files.
Solution
The gst-plugins-bad 1.28.4 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer 1.28.4 release
Patches
