Quick answers
- Is CVE-2026-121629 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121629 being exploited in the wild.
- How severe is CVE-2026-121629?
- High severity, with a CVSS score of 7.5, published 9 November 2026.
- Which products and versions are affected?
- Gstreamer Gst-Plugins-Good 1.26.0 and later, including 1.28.x up to 1.28.8.
- Is there a fix for CVE-2026-121629?
- Yes: fixed in gst-plugins-good 1.28.9 or later. Until then: Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-11-09"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121629 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-121629?
- Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: gst-plugins-good 1.28.9 or later
Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-11-09"}]
Technical details
The vulnerability is an insufficient URI scheme validation (CWE-73) in GStreamer's adaptive streaming demuxers. When processing HLS, DASH, or MSS manifests, the demuxer fetches URIs without restricting schemes to HTTP/HTTPS, allowing an attacker to inject file:// URIs pointing to local files. An attacker must control or inject content into a manifest URL (via network positioning or control); the demuxer then reads and processes the referenced local files, leaking their content or inferring their existence through error responses.
Affected products
- GStreamer gst-plugins-good 1.26.0 and later, including 1.28.x up to 1.28.8