GStreamer Gst-Editing-Services up to 1.28.7 Pipeline Parser input validation

Summaryinfo

A vulnerability identified as critical has been detected in GStreamer Gst-Editing-Services up to 1.28.7. Affected by this vulnerability is an unknown functionality of the component Pipeline Parser. This manipulation causes input validation. This vulnerability is tracked as CVE-2026-116612. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in GStreamer Gst-Editing-Services up to 1.28.7. Affected by this vulnerability is some unknown functionality of the component Pipeline Parser. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

It is possible to read the advisory at gstreamer.freedesktop.org. This vulnerability is known as CVE-2026-116612 since 10/26/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.28.8 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Multimedia Processing Software

Vendor

• GStreamer

Name

• Gst-Editing-Services

Version

• 1.28.0
• 1.28.1
• 1.28.2
• 1.28.3
• 1.28.4
• 1.28.5
• 1.28.6
• 1.28.7

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion