{"id":"CVE-2026-116612","kind":"vulnerability","aliases":["CVE-2026-116612"],"related":[],"title":"GStreamer Editing Services: project files can run arbitrary pipeline elements","description":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.","summary":"A GStreamer Editing Services project file can embed a pipeline description that is instantiated without limits on which elements or properties it uses. A crafted file can read or write local files, make outbound requests, crash the application, and in some conditions lead to code execution.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-editing-services","fixed":["1.28.8"],"affected":"< 1.28.8","ecosystem":"gstreamer"}],"ecosystems":[],"tags":["desktop-media","gst-editing-services","gstreamer","linux","package","thumbnailer"],"not_affected_if":["ges-not-installed","gst-editing-services-1.28.8+","no-untrusted-project-files"],"how_to_check":"Run pkg-config --modversion ges-1.0 (affected if < 1.28.8). Check whether the GES plugin is present with gst-inspect-1.0 ges. If it is present, any GStreamer player or thumbnailer on the host (file manager, media player) can auto-parse a crafted file.","fix":"Upgrade gst-editing-services (GES) to 1.28.8 or later (distro packages: check for backport of GStreamer-SA-2026-0090). Mitigation: uninstall the GES plugin, or set the rank of its project demuxer to NONE.","status":"open","published_at":"2026-10-26T17:17:27+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:02+00:00","updated_at":"2026-10-26T17:34:08+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-26T17:33:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GStreamer Editing Services: project files can run arbitrary pipeline elements","impact":"high","summary":"A GStreamer Editing Services project file can embed a pipeline description that is instantiated without limits on which elements or properties it uses. A crafted file can read or write local files, make outbound requests, crash the application, and in some conditions lead to code execution.","category":"package","nicknames":[],"who_cares":["gstreamer","gst-editing-services","linux","desktop-media"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads or writes local files and may achieve code execution","analyst_note":"Find the fixed GES version and whether thumbnailers trigger parsing automatically, using the NVD entry and upstream GStreamer advisory.","how_to_check":"- Check whether `gst-editing-services` is installed and its version, for example with `pkg-config --modversion ges-1.0`\n- Find applications that open GES project files or run GStreamer thumbnailing, such as editors and media or file-manager thumbnailers","needs_analyst":true,"not_affected_if":["ges-not-installed","no-untrusted-project-files"],"who_is_affected":"Systems with GStreamer Editing Services installed that load GES project files, whether through an editing application or automatically through a media player or file-manager thumbnailer that uses GStreamer autoplugging. The sources do not name fixed versions. Systems without GES installed, or that never open untrusted project files, are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3445,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed GES version and whether thumbnailers trigger parsing automatically, using the NVD entry and upstream GStreamer advisory.","search":"'-116612':13A,16A '-2026':12A,15A 'achiev':205C 'applic':69B,116C,190C 'arbitrari':8A,97C,175C 'attack':156C,184C 'attacker-control':183C 'automat':118C 'autoplug':132C 'capabl':200C 'caus':188C 'certain':194C 'code':76B,206C 'condit':73B,195C 'control':185C 'craft':56B,161C 'crash':67B,192C 'cve':11A,14A 'definit':104C 'deliv':159C 'descript':42B,100C,135C 'desktop':22B 'desktop-media':21B 'edit':2A,26B,34B,84C,88C,115C 'editing':19A 'effect':103C 'either':111C 'element':10A,50B,144C 'emb':39B,95C 'execut':77B,207C 'explicit':112C 'file':5A,37B,57B,63B,93C,108C,125C,163C,177C,198C 'file-manag':124C 'file-writ':197C 'flaw':79C 'found':81C 'ges':91C 'gst':18A,25B,87C 'gst-editing-servic':24B,86C 'gst-editing-services':17A 'gstreamer':1A,28B,33B,83C,98C,131C 'instanti':45B,139C 'issu':178C 'lead':74B 'leverag':203C 'limit':47B 'linux':29B 'load':110C 'local':62B,176C 'make':64B 'manag':126C 'may':145C,151C,201C 'media':23B,121C 'network':180C 'outbound':65B,179C 'packag':30B 'pars':137C 'pipelin':9A,41B,99C,134C 'player':122C 'project':4A,36B,92C,162C 'properti':52B,150C 'read':59B,171C 'remot':155C 'request':66B,181C 'restrict':141C 'run':7A 'server':186C 'servic':3A,27B,35B,85C,89C,128C 'services':20A 'set':153C 'system':168C 'thumbnail':31B,127C 'trigger':170C 'use':54B,130C,147C 'victim':166C 'without':46B,140C 'write':61B,173C,199C","nicknames":[],"mitigations":[],"who_affected":"Any system with GStreamer Editing Services < 1.28.8 installed that opens or thumbnails untrusted files with GStreamer: Linux desktops, file-manager thumbnailers, media players, upload or preview services that run GStreamer. Files are recognized by content, not extension, so renaming does not help. Systems without the GES plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-26T17:34:08Z","by":"analyst","run_id":838},"mitigations":{"at":"2026-10-26T17:34:08Z","by":"analyst","run_id":838},"how_to_check":{"at":"2026-10-26T17:34:08Z","by":"analyst","run_id":838},"who_affected":{"at":"2026-10-26T17:34:08Z","by":"analyst","run_id":838}},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116612","severity":null,"published_at":"2026-10-26T17:17:27+00:00","modified_at":"2026-10-26T17:17:27+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116612:838","url":null,"severity":null,"published_at":"2026-10-26T17:34:08+00:00","modified_at":"2026-10-26T17:34:08+00:00","first_seen_at":"2026-10-26T17:34:08+00:00","fetched_at":"2026-10-26T17:34:08+00:00","note":"Read GStreamer-SA-2026-0090 (upstream): fixed in gst-editing-services 1.28.8; thumbnailers/players auto-select the project demuxer by content, so opening or thumbnailing a file triggers it. Advisory says no CVE assigned; NVD page had no content, so the CVE-to-advisory link is unconfirmed. No exploitation or PoC mentioned; not searched socially."}],"documents":[{"id":3994,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0090.html","title":"GStreamer-SA-2026-0090","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}