CVE-2026-121629: 
Linux Red Hat 脆弱性分析と緩和策

CVE-2026-121629 is a local file disclosure vulnerability in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS) caused by unrestricted URI scheme handling during manifest processing. An unauthenticated remote attacker who controls a manifest URL or can inject content into an HTTP manifest response can embed file:// URIs to read arbitrary local files from the host system. The flaw affects gstreamer1-plugins-good versions >= 1.26.0 (where the file:// read path was introduced); versions prior to 1.26.0 are not practically exploitable because the libsoup download path rejected file:// URIs natively. The fix is included in upstream version 1.28.9 (unreleased as of the disclosure date). It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path). The downloadhelper_submit_request() function in ext/adaptivedemux2/downloadhelper.c (line 1153) routes URIs beginning with file:// to GLib's GFile async I/O path, enabling local file access. Critically, the only URI scheme validation in the codebase (gstadaptivedemux.c lines 1080–1083) applies solely to the manifest's own URI — not to URIs extracted from manifest content such as DASH BaseURL elements, xlink:href attributes (actuate='onLoad'), SegmentURL media/index attributes, and HLS EXT-X-KEY URI values. These untrusted URIs are resolved and passed directly to the download helper without any scheme restriction, allowing an attacker to inject file:// URIs that cause the application to open and read arbitrary local files. The file:// read path was introduced in GStreamer 1.26.0 (commit f2a18ab277, 2024-07-30), and the vulnerability was reported by GStreamer maintainer Sebastian Dröge (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in high confidentiality impact: file bytes are placed into GStreamer buffers and can be forwarded downstream — written to disk, relayed over a network, or inferred via error-code oracles. In automated or server-side deployments such as media recorders, transcoding proxies, and stream downloaders, this can lead to disclosure of sensitive local files including configuration files, credentials, and system files accessible to the GStreamer process. Even when file content is not directly observable, an attacker can infer the existence of specific files through differing error responses. There is no integrity or availability impact (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Red Hat CVE). The vulnerability is exploitable by unauthenticated network attackers with no user interaction required, making it particularly dangerous in automated server-side pipelines. The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify a target: Locate a server-side or automated GStreamer deployment (media recorder, proxy, downloader, transcoder) running gstreamer1-plugins-good >= 1.26.0 that processes HLS, DASH, or MSS manifests from external or attacker-influenced sources.
2. Control or intercept the manifest: Either serve a malicious manifest from an attacker-controlled URL, or perform a man-in-the-middle attack on an HTTP (non-TLS) manifest response to inject malicious content.
3. Craft a malicious manifest: Embed file:// URIs pointing to target local files within the manifest content. For DASH, use BaseURL elements or xlink:href attributes (e.g., <BaseURL>file:///etc/passwd</BaseURL>). For HLS, use the EXT-X-KEY URI field (e.g., URI="file:///etc/shadow").
4. Trigger manifest processing: Cause the target GStreamer application to fetch and process the malicious manifest, either by directing it to the attacker-controlled URL or by delivering the injected HTTP response.
5. Retrieve file contents: The GStreamer application reads the local file and places its bytes into pipeline buffers. In server-side deployments, these buffers may be written to output files, forwarded over the network, or exposed via error messages — allowing the attacker to retrieve the file contents.
6. Infer file existence (oracle attack): Even if content is not directly observable, send manifests referencing different file paths and analyze differing error responses to determine whether specific files exist on the target system (Red Hat Bugzilla, Red Hat CVE).

• Network: Outbound HTTP/network requests from a GStreamer-based application to attacker-controlled manifest URLs; GStreamer pipeline output (e.g., recorded media files or forwarded streams) containing unexpected binary or text data consistent with local system files.
• Logs: Application or GStreamer debug logs showing file:// URI resolution attempts originating from manifest content (e.g., file:///etc/passwd, file:///etc/shadow, file:///proc/self/environ); GStreamer error messages referencing unexpected local file paths during adaptive streaming demux operations.
• File System: Output files from media recording or proxy pipelines containing content that does not match expected media data (e.g., plaintext configuration or credential file content embedded in output).
• Process: GStreamer processes (gst-launch, custom pipeline applications) making unexpected GLib GFile async I/O calls to local filesystem paths during adaptive streaming playback or recording (Red Hat Bugzilla).

The upstream fix is included in GStreamer 1.28.9 (unreleased as of the disclosure date); users should apply patches as soon as they become available from GStreamer and their Linux distribution. Red Hat notes that RHEL 9 and earlier streams ship versions below 1.26.0 and are not affected; RHEL 10.2+, RHIVOS 2.1+, Fedora 43, Fedora 44, and Rawhide are affected and should be patched when fixes are released. As interim workarounds: avoid opening HLS, DASH, or MSS manifests from untrusted network sources; run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers restricted to only required directories; and use network controls to limit which manifest hosts the application may contact. Implementing strict URI scheme allowlisting (permitting only http:// and https://) in manifest processing is the recommended architectural fix (Red Hat CVE, Red Hat Bugzilla).

Red Hat rated this vulnerability as Important, noting that a remote party supplying or influencing an adaptive streaming manifest can cause GStreamer to read local files with high confidentiality impact in pipeline deployments (Red Hat CVE). The vulnerability was reported by Sebastian Dröge, a GStreamer maintainer, and tracked under upstream advisory GStreamer-SA-2026-0097 (Red Hat Bugzilla). No significant broader community or social media discussion has been observed beyond standard vulnerability database aggregation.