Vulnerability in GStreamer Adaptive Streaming Demuxers Leading to Unauthorized File Access
CVE-2026-121629
What is CVE-2026-121629?
A security flaw exists in GStreamer's adaptive streaming demuxers, specifically within HLS, DASH, and MSS protocols. This issue arises when processing media playlists or manifests, where URIs referenced in the manifest are fetched without adequate constraints on permissible URI schemes. An attacker with control over a manifest URL or the ability to inject content into an HTTP manifest response can potentially include file:// URIs that point to arbitrary local files. This could lead to unauthorized reading and processing of sensitive local files by affected applications, particularly in automated or server-side setups such as media recorders or downloaders. The presence of sensitive files can also be inferred through variable error messages, even if the content itself remains inaccessible.