CVE-2026-116612
Publiée le 2026-10-26 · Dernière modification le 2026-10-27
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
DÉTAIL DU VECTEUR CVSS
🇬🇧 WHY IT MATTERS (en anglais)
GStreamer Editing Services (gst-editing-services) is a framework used by media players, file managers, and editing software to handle project files. The flaw exists because the software allows project files to embed arbitrary pipeline descriptions as effect definitions. When these files are loaded, the system instantiates these pipelines without restricting which elements are used or which properties are modified. An attacker can exploit this by tricking a user into opening a specially crafted project file, which could happen during manual loading or automatic thumbnail generation. This allows the attacker to read or write local files, trigger unauthorized network requests, or crash the application, potentially leading to full remote code execution. Because it requires user interaction and local file delivery, it is not a network-based attack, but it carries a high impact on confidentiality, integrity, and availability.