Security Advisory 2026-0097 (CVE-2026-121629)
| Summary | Local file disclosure via manifest references in adaptive streaming (HLS/DASH) demuxers |
| Date | 2026-11-06 |
| Affected Versions | GStreamer gst-plugins-good < 1.28.9 |
| IDs | GStreamer-SA-2026-0097 CVE-2026-121629 |
Details
The adaptive streaming (HLS and DASH) demuxer framework in gst-plugins-good obtains the locations of sub-manifests, media segments, initial segments and encryption keys from stream manifests, which may be served by a remote and potentially malicious content provider. The URI scheme of these references was not restricted, so references to the local filesystem were followed even when the manifest itself was loaded over the network. A remote manifest could therefore make an application open and read arbitrary local files, with the file contents entering the pipeline under attacker control.
The same class of vulnerability, remote manifests being able to reference local files, is also addressed in FFmpeg (CVE-2026-107697).
Impact
A remote attacker who controls a manifest or playlist consumed by an application can make it read arbitrary local files. This is not limited to the local user viewing their own files: the same library is used by applications that fetch attacker-supplied manifest URLs and handle the resulting data programmatically, such as downloaders, proxies, media servers, and recording or streaming pipelines. In such deployments the content of local files can be written to disk or transmitted back to the attacker, resulting in information disclosure. Encryption key references additionally allow parts of arbitrary files to be exposed through decryption of attacker-chosen data or in debug logs, and differing failure behavior can act as an oracle for the existence of local files.
References to special or infinite local files can also cause endless processing and resource exhaustion, leading to denial of service.
Solution
The gst-plugins-good 1.28.9 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.