# CVE-2026-121629: GStreamer adaptive streaming demuxers local file disclosure via unvalidated URIs

Source: https://junglewise.ai/threats/cve-2026-121629-a-flaw-was-found-in-gstreamer-s-adaptive-streaming-demuxers-hls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-121629 · Severity: high · CVSS 7.5 · Published 2026-11-09

GStreamer is a multimedia processing library used in media players, recorders, and streaming proxies. A flaw in its HLS, DASH, and MSS streaming handlers allows attackers who control a manifest file to inject file:// URIs that force the application to read arbitrary local files, potentially exposing sensitive data like configuration files or credentials in automated deployments.

Technologies: [Gstreamer Gst-Plugins-Good](https://junglewise.ai/threats/technologies/gstreamer-gst-plugins-good). Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-121629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121629 being exploited in the wild.

**How severe is CVE-2026-121629?** High severity, with a CVSS score of 7.5, published 9 November 2026.

**Which products and versions are affected?** Gstreamer Gst-Plugins-Good 1.26.0 and later, including 1.28.x up to 1.28.8.

**Is there a fix for CVE-2026-121629?** Yes: fixed in gst-plugins-good 1.28.9 or later. Until then: Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-11-09"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121629 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-121629?** Check whether you run Gstreamer Gst-Plugins-Good at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in gst-plugins-good 1.28.9 or later

Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-11-09"}]

## Technical details

The vulnerability is an insufficient URI scheme validation (CWE-73) in GStreamer's adaptive streaming demuxers. When processing HLS, DASH, or MSS manifests, the demuxer fetches URIs without restricting schemes to HTTP/HTTPS, allowing an attacker to inject file:// URIs pointing to local files. An attacker must control or inject content into a manifest URL (via network positioning or control); the demuxer then reads and processes the referenced local files, leaking their content or inferring their existence through error responses.

## Affected products

- GStreamer gst-plugins-good 1.26.0 and later, including 1.28.x up to 1.28.8

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-121629](https://access.redhat.com/security/cve/CVE-2026-121629)

## Related threats

- [GStreamer gst-plugins-good out-of-bounds heap read in qtdemux](https://junglewise.ai/threats/cve-2026-125041-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-mov-mp4-demuxer)
- [GStreamer gst-plugins-good H.264 RTP depayloader heap read overflow](https://junglewise.ai/threats/cve-2026-119610-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-specifically-in)
- [GStreamer gst-plugins-good avidemux denial of service](https://junglewise.ai/threats/cve-2026-73473-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good integer overflow in AVI parser](https://junglewise.ai/threats/cve-2026-73472-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)
- [GStreamer gst-plugins-good out-of-bounds read in Nikon metadata parser](https://junglewise.ai/threats/cve-2026-73471-a-flaw-was-found-in-gstreamer-gst-plugins-good-avidemux-in-the)