---
id: "CVE-2026-116612"
kind: "vulnerability"
aliases: ["CVE-2026-116612"]
title: "GStreamer Editing Services: project files can run arbitrary pipeline elements"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "gst-editing-services", "fixed": ["1.28.8"], "affected": "< 1.28.8", "ecosystem": "gstreamer"}]
ecosystems: []
tags: ["desktop-media", "gst-editing-services", "gstreamer", "linux", "package", "thumbnailer"]
not_affected_if: ["ges-not-installed", "gst-editing-services-1.28.8+", "no-untrusted-project-files"]
published_at: "2026-10-26T17:17:27+00:00"
first_seen_at: "2026-10-26T17:31:22+00:00"
updated_at: "2026-10-26T17:34:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116612", "first_seen_at": "2026-10-26T17:31:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T17:34:08+00:00"}]
---

# GStreamer Editing Services: project files can run arbitrary pipeline elements

A GStreamer Editing Services project file can embed a pipeline description that is instantiated without limits on which elements or properties it uses. A crafted file can read or write local files, make outbound requests, crash the application, and in some conditions lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- gstreamer:gst-editing-services affected < 1.28.8 fixed 1.28.8

## How to check

Run pkg-config --modversion ges-1.0 (affected if < 1.28.8). Check whether the GES plugin is present with gst-inspect-1.0 ges. If it is present, any GStreamer player or thumbnailer on the host (file manager, media player) can auto-parse a crafted file.

## Fix

Upgrade gst-editing-services (GES) to 1.28.8 or later (distro packages: check for backport of GStreamer-SA-2026-0090). Mitigation: uninstall the GES plugin, or set the rank of its project demuxer to NONE.

## Timeline

- 2026-10-26T17:31:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116612
- 2026-10-26T17:34:08+00:00 analyst — Read GStreamer-SA-2026-0090 (upstream): fixed in gst-editing-services 1.28.8; thumbnailers/players auto-select the project demuxer by content, so opening or thumbnailing a file triggers it. Advisory says no CVE assigned; NVD page had no content, so the CVE-to-advisory link is unconfirmed. No exploitation or PoC mentioned; not searched socially.

## Documents

- [advisory] GStreamer-SA-2026-0090 https://gstreamer.freedesktop.org/security/sa-2026-0090.html

## From the sources

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_