A vulnerability exists in GStreamer's MXF demuxer plugin (gst-plugins-bad) where it improperly indexes internal tables using unvalidated values from specially crafted MXF media files. This can cause a denial of service (application crash) and may allow limited reading of adjacent heap memory. Exploitation requires a local attacker to trick a user into opening a malicious MXF file. No code execution or write primitives have been demonstrated. Red Hat Enterprise Linux versions 9.4 and later, Red Hat Enterprise Linux 10, Red Hat In-Vehicle Operating System, and current Fedora streams with GStreamer versions 1.22.x through 1.28.8 are affected. Earlier Red Hat versions and RHEL 9.2 with GStreamer 1.18.4 are not affected. Mitigation involves avoiding untrusted MXF files or disabling the mxfdemux plugin until a fixed package is available.