CVE-2026-116612: High severity GStreamer GStreamer Editing Services (gst-editing-services) vulnerability
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems are exposed when an editing application explicitly loads a crafted GES project file, or when a media player or file-manager thumbnailing service automatically loads it through GStreamer autoplugging. An attacker needs to deliver the crafted project file to the victim and induce or rely on it being processed.
Is user interaction required?
The supplied severity vector indicates user interaction is required. However, processing may occur automatically if a media player or file-manager thumbnailing service uses GStreamer autoplugging.
What can a successful exploit do?
A crafted project can cause arbitrary local-file reads or writes, outbound requests to attacker-controlled servers, or an application crash. In certain conditions, the file-write capability may be leveraged for code execution.
What configuration behavior creates the exposure?
The issue occurs because effect definitions can contain arbitrary GStreamer pipeline descriptions that are parsed and instantiated without restrictions on allowed elements or properties. Automatic handling of project files by GStreamer-enabled thumbnailing or playback components can create exposure even when an editing application is not deliberately opened.