Arbitrary Code Execution Vulnerability in GStreamer Editing Services
CVE-2026-116612

7.8HIGH

Key Information:

Vendor

Gstreamer Project

Status
Gst-editing-services
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116612?

A vulnerability exists in GStreamer Editing Services where a crafted project file can lead to the execution of arbitrary code due to unrestricted parsing of GStreamer pipeline descriptions. When these project files are processed by editing applications or media players utilizing GStreamer autoplugging, it permits remote attackers to execute unauthorized operations, including accessing local files, making outbound requests, or potentially crashing the application. In certain circumstances, this capability might even be exploited for remote code execution.

Affected Version(s)

gst-editing-services 0 < 1.28.8

gst-editing-services 1.28.8

References

https://gstreamer.freedesktop.org/security/sa-2026-0090.html
vendor-advisory
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merg...
patch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Dröge (Centricular)
.