GStreamer: Arbitrary local file read via adaptive streaming demuxers (CVE-2026-121629)
A vulnerability in GStreamer adaptive streaming demuxers allows attackers to read arbitrary local files by injecting file:// URIs into media manifests.
CVE search metadata
CVE search record: CVE-2026-121629. Severity: high. CVSS: 7.5. KEV: no. Product: GStreamer (adaptive streaming demuxers), GStreamer. Brief: GStreamer: Arbitrary local file read via adaptive streaming demuxers (CVE-2026-121629). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gstreamer-uri-traversal/
Triage facts
Revision 2- Applicability
- GStreamer (adaptive streaming demuxers), GStreamer
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 9, 16:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
added coverage for GStreamer
Changed: action_plan, affected_products, lastmod, priority_signals, references, tags, updates
Sources: 1
A vulnerability exists in GStreamer's adaptive streaming demuxers (HLS, DASH, and MSS) where URI schemes for remote resources are not validated during the processing of media manifests. An attacker who can influence the manifest URL or inject content into the manifest response can force the GStreamer-based application to process file:// URIs. This results in the application reading local files from the filesystem. In server-side environments such as media proxies, recorders, or downloaders, this can lead to the disclosure of sensitive files or the enumeration of file existence via error responses.
Impact
Successful exploitation allows unauthorized disclosure of arbitrary local files accessible to the application process. Attackers may also infer the existence of files on the system based on differential error responses returned by the application.
Recommendation
- Inventory all applications and services utilizing GStreamer for adaptive media streaming (HLS, DASH, MSS) to identify potential exposure.
- Implement strict input validation or sanitization for all media manifest URIs to ensure only expected schemes (e.g., http, https) are processed.
- Monitor for applications attempting to access unauthorized local file paths via network-oriented media processing components.
- Patch or update GStreamer libraries as soon as an official security update is released by the GStreamer maintainers for CVE-2026-121629.
Immediate actions
Inventory applications using GStreamer libraries for HLS, DASH, or MSS streaming.
Perform an inventory of all installed software to identify dependencies on GStreamer libraries
Threat Hunt
Identify applications performing unexpected file I/O operations from within network-facing media processing components.
Data: Process file system activity logs (e.g., procmon, auditd) filtered by processes using GStreamer libraries.
Mitigations
Apply vendor patches for CVE-2026-121629 when available.
CVE-2026-121629
Apply security updates as soon as GStreamer project releases patches for these identified vulnerabilities
Multiple GStreamer vulnerabilities