Security Advisory 2026-0029

Details

Bounds check errors in the MXF demuxer and muxer when handling VANC (Vertical Ancillary Data) packets. The demuxer had insufficient and incorrect bounds checks when parsing multiple VANC packets per edit unit, including unchecked accesses to bit and byte readers, and missing validation of array sizes. The muxer had incorrect size calculations when writing VANC packets, computing wrong packet and wrapper sizes.

Impact

A malicious third party could trigger out-of-bounds reads or incorrect buffer operations by providing a crafted MXF file with invalid VANC packet configuration, potentially resulting in a crash, data corruption, or denial of service.

Solution

The gst-plugins-bad 1.28.3 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.3 release

• Release Notes
• GStreamer Plugins Bad 1.28.3

Patches

• Patch