Read the docs
TI-2026-80503 Aliases CVE-2026-116612GHSA-hq2c-jhr8-9ffr

Unrestricted pipelines in GStreamer Editing Services project files

Priority LOW 36CWE-913Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

GStreamer Editing Services (gst-editing-services) from 0 before 1.28.8 is affected. A GES project file can embed an arbitrary GStreamer pipeline description as an effect, and that pipeline is instantiated without restriction on which elements or properties it uses (CWE-913). A remote attacker who delivers a crafted project file can make a victim's system read or write arbitrary local files, send outbound network requests, or crash, and under certain conditions the file write can lead to code execution. The file is loaded when a user opens it or when a media player or file manager thumbnails it, and the attacker needs the victim to open or view the file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Fix Fixed gst-editing-services (GStreamer project): 1.28.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GStreamer projectgst-editing-servicesbefore 1.28.81.28.8Patch availableCNA
  • gst-editing-services VendorGStreamer project Affected before 1.28.8 Fixed in 1.28.8 Patch available CNA

Remediation

Update GStreamer Editing Services (gst-editing-services) to version 1.28.8, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA gst-editing-services (GStreamer project) Fixed in 1.28.8

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116612
  2. 2026-10-27 CISA SSVC decision points changed
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Affected versions changed · Red Hat
  5. 2026-10-27 CVSS score added · Red Hat
  6. 2026-10-27 Alias added: GHSA-hq2c-jhr8-9ffr

References

Patch 1

Advisory 1

  • TI-2020-04962 NULL pointer dereference in GStreamer CVSS 3.1HIGH 7.5
  • TI-2026-84195 Reachable assertion in GStreamer FLV demuxer crashes on malformed tags CVSS 3.1MEDIUM 6.5
  • TI-2026-83337 NULL pointer dereference in GStreamer MicroDVD subtitle parser CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences