RHSA-2026:98644HighCVSS 7.5

Red Hat Security Advisory: gstreamer1-plugins-good security update

Published
November 11, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-121629 →

📋 Description

CVE-2026-121629 — gst-plugins-good: gst-plugins-good: Local file disclosure via unvalidated file:// URIs in adaptivedemux2 manifest handling

🎯 Affected products26

  • Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-0:1.26.7-10.el10_3.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debuginfo-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debuginfo-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debuginfo-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debuginfo-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debugsource-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debugsource-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debugsource-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-debugsource-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-gtk-debuginfo-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-qt6-debuginfo-0:1.26.7-10.el10_3.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-qt6-debuginfo-0:1.26.7-10.el10_3.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-qt6-debuginfo-0:1.26.7-10.el10_3.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • gstreamer1-plugins-good-qt6-debuginfo-0:1.26.7-10.el10_3.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact. These measures reduce risk but do not remove the vulnerability.

🔗 References (4)