CVE-2026-121629: Red Hat Enterprise Linux (high)

Summary

GStreamer's adaptive streaming demuxers (HLS, DASH, and MSS) can be tricked into reading arbitrary local files when they process a manifest, because they fetch URIs from the manifest without restricting the URI scheme. An attacker who controls a manifest URL or can inject content into an HTTP manifest response can reach this remotely, without logging in, to disclose sensitive files on the affected system, particularly in server-side tools such as recorders, proxies, and downloaders.

Read the original description

A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.

cve.now Index

35Pcve.now Index 35 of 100 · methodology v3 · provisional

Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
Exposure17/25No login or user action needed, reachable over the network without a login · Unknown: Advisories don't say whether default setups are affected
Reach10/20Shipped in major Linux distributions
Severity7.5/10CVSS 7.5
No patch0/5No signal

What would change the score

Would score about 80 if added to CISA KEV
Would score about 75 if CISA's SSVC rates exploitation active
Would score about 40 if advisories confirm default setups are exposed

How the score works · Rankings

What to do

Upgrade to a fixed version: 1.28.9.
Workaround: Avoid opening HLS, DASH, or MSS manifests from untrusted network sources.

Timeline

Nov 9, 2026, 11:35 AM UTCCVE published
Nov 9, 2026, 11:39 AM UTCFirst seen by cve.now

Affected versions

gstreamer1-plugins-good
Version range not reported
gstreamer-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported
gstreamer-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported
gstreamer1-plugins-good
Version range not reported

Evidence 4

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-121629

Is CVE-2026-121629 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

What does this mean?

Unvalidated file:// URIs in adaptivedemux2 manifest handling let a crafted manifest make the application read and process local files it can access, which can disclose sensitive files. Differences in error responses can also reveal whether a file exists.Source: bugzilla.redhat.com, access.redhat.com

Am I affected, and how do I check?

Versions gst-plugins-good 1.26.0 and newer include the file:// read path. Exposure requires an application that opens HLS, DASH, or MSS manifests whose URL or content an attacker controls or can inject into. To check the installed version, query the gst-plugins-good package with the distribution's package manager.Source: bugzilla.redhat.com, access.redhat.com

How do I fix CVE-2026-121629?

Upgrade gst-plugins-good to 1.28.9. Until the upgrade is applied, avoid opening HLS, DASH, or MSS manifests from untrusted network sources.Source: bugzilla.redhat.com, access.redhat.com

Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling