CVE-2026-111728 5rahim CVE debrief

Who should care

Defenders of Seanime installations, especially those exposed to LAN or Tailnet clients, should assess their exposure and prioritize updating to version 3.10.4 or later, review compensating controls for exposed systems, and monitor for suspicious activity on the host running Seanime, with security teams verifying affected versions and remediation status to ensure comprehensive risk assessment and mitigation.

Why it matters

CVE-2026-111728 is a medium-severity vulnerability in Seanime that allows unauthenticated LAN or Tailnet clients to bypass security guards and potentially achieve arbitrary file write, read, and data exfiltration. Defenders of Seanime installations, especially those exposed to LAN or Tailnet clients, should assess their exposure and prioritize updating to version 3.10.4 or later.

• Potential arbitrary file write and file truncation on the host as the user running Seanime
• Potential arbitrary local file read through ffmpeg's protocol handlers
• Potential outbound data exfiltration through ffmpeg's protocol handlers
• Verification of affected versions and remediation status is required

Technical summary

The vulnerability allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field. This can lead to arbitrary file write, file truncation, local file read, and data exfiltration through ffmpeg's protocol handlers, with defenders needing to review compensating controls and prioritize updates to version 3.10.4 or later for exposed systems, while validating affected scope and vendor guidance.

Defensive priority

Medium priority for defenders of Seanime installations, especially those exposed to LAN or Tailnet clients.

Recommended defensive actions

• Update Seanime to version 3.10.4 or later
• Restrict access to the mediastream request and HLS playlist endpoints
• Monitor for suspicious activity on the host running Seanime
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in Seanime versions 3.7.0 to 3.10.3. The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources may be necessary for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.