What happened
CVE-2026-121629 is a flaw in GStreamer's adaptive streaming demuxers for HLS, DASH and MSS. When a media playlist or manifest is processed, referenced URIs are fetched without restricting the permitted URI schemes. A manifest controlled by an attacker, or content injected into an HTTP manifest response, can contain <code>file://</code> URIs pointing to local files. The affected application may then read and process those files. In automated or server-side deployments, including media recorders, proxies and downloaders, this may disclose sensitive local files. Differing error responses may also reveal whether files exist when their contents cannot be observed directly. The reported attack is reachable over a network, requires no prior access and involves no user action. NVD assigns high severity, with a score of 7.5.
Who is affected
The supplied vulnerable-component identification is Red Hat Enterprise Linux 10. The reported flaw concerns applications processing manifests with GStreamer's HLS, DASH or MSS adaptive streaming demuxers. The exact affected scope is not yet available: NVD analysis remains in progress and the scope may change. Patch status is not stated. The vendor advisory should be checked for fixed versions.
Recommended actions
- Restrict network exposure of services that process media playlists or manifests, particularly exposed automated or server-side services.
- Segment affected services from other systems to limit access across network boundaries.
- Place access controls in front of exposed services that process manifests.
- Check the vendor advisory for fixed versions and apply an applicable fix to affected deployments.
