medium · CVSS v3 5.5

CVE-2026-125703

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data …

Description

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
5.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-89115

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

View analysis

medium

CVE-2026-89128

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

View analysis

medium

CVE-2026-89129

SAP NetWeaver AS Java Web Services is vulnerable to an unauthenticated Server‑Side Request Forgery (SSRF) that allows an attacker to trigger a SOAP fault to a URL under their control. This flaw can leak information about internal systems, compromising confidentiality. The vulnerability does not affect integrity or availability.

View analysis

medium

CVE-2026-89131

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

View analysis