Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by fedora

CVE-2026-116612

High 7.8

In plain English

A high-severity security flaw in gst-editing-services from GStreamer project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 86.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gstreamer-editing-services1.0no fix listedDEBIAN-CVE-2026-116612
Debian:13gstreamer-editing-services1.0no fix listedDEBIAN-CVE-2026-116612
Debian:14gstreamer-editing-services1.01.28.8-1DEBIAN-CVE-2026-116612
Ubuntu:22.04:LTSgstreamer-editing-services1.0no fix listedUBUNTU-CVE-2026-116612
Ubuntu:24.04:LTSgstreamer-editing-services1.0no fix listedUBUNTU-CVE-2026-116612
Ubuntu:26.04:LTSgstreamer-editing-services1.0no fix listedUBUNTU-CVE-2026-116612
Ubuntu:26.10gstreamer-editing-services1.0no fix listedUBUNTU-CVE-2026-116612

Affected products (as reported)

VendorProductVersions
GStreamer project gst-editing-services 0 – before 1.28.8

Weakness: CWE-913 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References