A flaw in GStreamer’s adaptive streaming demuxers allows an attacker to embed file:// URIs in HLS, DASH, or MSS manifests. When the application processes such a manifest, it retrieves the referenced local file without imposing any scheme restrictions. This behavior enables the reading of arbitrary files on the system, potentially exposing sensitive data. Even if the file contents are not directly delivered, the differing error responses can reveal the presence of files, allowing an attacker to infer file existence.

The vulnerability affects GStreamer installed on Red Hat Enterprise Linux across multiple releases, specifically versions 6, 7, 8, 9, and the long‑term support release 10. The affected packages are part of the RHEL distribution and also present in the RHEL ELS streams for versions 6 and 7.

The CVSS score of 7.5 indicates a high‑severity risk, while the EPSS value is not available, leaving the likelihood of exploitation uncertain. The vulnerability is not currently listed in the CISA KEV catalog. An attacker controlling a manifest source—either by hosting a malicious URL or influencing the HTTP response for a manifest—can exploit the flaw by delivering a manifest containing file:// URIs. This can happen in automated or server‑side deployments such as media recorders, proxies, or downloaders, leading to disclosure of local files or inference about their existence. Without a vendor patch, the risk remains significant for environments that process untrusted streaming manifests.