CVE-2026-121629
Awaiting Analysis Awaiting Analysis - Queue

GStreamer Adaptive Streaming URI Scheme Bypass

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: redhat-SADP

Description
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121629
EUVD
EUVD-2026-119997

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) where URIs in media playlists or manifests are fetched without validating URI schemes. Attackers can include file:// URIs pointing to arbitrary local files, causing the application to read those files. This leads to local file disclosure in automated or server-side deployments.

Detection Guidance

To detect this vulnerability, check if your GStreamer version is 1.26.0 or later. Run: gst-inspect-1.0 --version. If the version is vulnerable, inspect manifests (HLS/DASH) for file:// URIs in BaseURL, xlink:href, SegmentURL, or EXT-X-KEY fields. Monitor network traffic for unexpected local file access attempts.

Impact Analysis

The impact includes disclosure of sensitive local files, potential data exfiltration, or denial of service via resource exhaustion. File contents may be exposed through encryption keys or debug logs. Attackers can also infer file existence through differing error responses even without direct content access.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations may face compliance violations due to potential data breaches from local file disclosure.

Mitigation Strategies

Upgrade GStreamer to version 1.28.9 or later. Avoid untrusted manifest sources. Run applications with minimal filesystem access using Linux namespaces or containers. Restrict network access to manifest hosts to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...