CVE-2026-125703

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1257047.5A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, a CVE-2026-1257066.5A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not CVE-2026-1257077.1A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-by CVE-2026-1257086.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons CVE-2026-1257094.2A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data in CVE-2026-125719.8An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.CVE-2026-125711The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking CVE-2026-1257127.5A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a CVE-2026-1257155.3Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or u CVE-2026-125727.2Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to c CVE-2026-125729Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce CVE-2026-125738.8Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading t