Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The MXF demuxer plugin in GStreamer's gst-plugins-bad (gstreamer1-plugins-bad-free) can be made to crash an application or read limited heap memory when it opens a specially crafted MXF file. A local attacker can trigger this without logging in, but only if a user is tricked into opening the malicious file.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
cve.now Index
- Exploitation0/40No signal
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Shipped in major Linux distributions
- Severity6.1/10CVSS 6.1
- No patch5/5No patch listed yet
What would change the score
- Would score about 76 if added to CISA KEV
- Would score about 71 if CISA's SSVC rates exploitation active
- Would score about 43 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- gstreamer1-plugins-bad-free
Version range not reported
- gstreamer-plugins-bad-free
Version range not reported
- gstreamer1-plugins-bad-free
Version range not reported
- gstreamer-plugins-bad-free
Version range not reported
- gstreamer1-plugins-bad-free
Version range not reported
- gstreamer1-plugins-bad-free
Version range not reported
Evidence 3
- Report
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.