GStreamer (Adaptive Streaming Demuxers) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gstreamer-adaptive-streaming-demuxers/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 13:48:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGStreamer: Arbitrary local file read via adaptive streaming demuxers (CVE-2026-121629)https://feed.craftedsignal.io/briefs/2026-11-gstreamer-uri-traversal/Mon, 09 Nov 2026 13:48:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gstreamer-uri-traversal/A vulnerability in GStreamer adaptive streaming demuxers allows attackers to read arbitrary local files by injecting file:// URIs into media manifests.A vulnerability exists in GStreamer's adaptive streaming demuxers (HLS, DASH, and MSS) where URI schemes for remote resources are not validated during the processing of media manifests. An attacker who can influence the manifest URL or inject content into the manifest response can force the GStreamer-based application to process file:// URIs. This results in the application reading local files from the filesystem. In server-side environments such as media proxies, recorders, or downloaders, this can lead to the disclosure of sensitive files or the enumeration of file existence via error responses.

Impact

Successful exploitation allows unauthorized disclosure of arbitrary local files accessible to the application process. Attackers may also infer the existence of files on the system based on differential error responses returned by the application.

Recommendation

  • Inventory all applications and services utilizing GStreamer for adaptive media streaming (HLS, DASH, MSS) to identify potential exposure.
  • Implement strict input validation or sanitization for all media manifest URIs to ensure only expected schemes (e.g., http, https) are processed.
  • Monitor for applications attempting to access unauthorized local file paths via network-oriented media processing components.
  • Patch or update GStreamer libraries as soon as an official security update is released by the GStreamer maintainers for CVE-2026-121629.
]]>highadvisoryvulnerabilityremote-code-execution