GStreamer Editing Services: Arbitrary element instantiation via project file
Summary
A flaw in the GStreamer Editing Services project file loader allows a crafted project file to embed a free-form pipeline description that is instantiated without restrictions on elements or properties. A remote attacker who delivers such a file to a victim can read or write arbitrary local files, send requests to attacker-controlled servers, or crash the application. Opening the file in a media player or having it thumbnailed can be enough to trigger the flaw, and under certain conditions the file-write capability may lead to code execution.
Affected
- GStreamer gst-editing-services versions below 1.28.8
- Distribution packages may carry older builds; check your vendor's package status
Fixed in
- gst-editing-services 1.28.8 (vendor fix; patch also available in the merge request)
- Fixed builds in distributions: Unknown.
Workaround
- Uninstall the GStreamer Editing Services plugin if it is not needed.
- Lower the rank of the project demuxer to NONE so it is not selected automatically.
- Do not open untrusted GES project files until the update is installed.
Exploitation
- Vendor and CNA data: CISA SSVC shows Exploitation: none and Automatable: no.
- A third-party tracker reports the issue as not known to be exploited.
- Public proof of concept: Unknown.
- CISA KEV status: Unknown.
Our recommendation
- Update gst-editing-services to 1.28.8 or later, or install the distribution package that contains the fix.
- Identify Linux workstations with GStreamer-based media players, editors or thumbnailers and check whether GES is installed.
- Until patched, remove the plugin where it is not needed or block untrusted project files in those applications.
- Prioritise workstations that handle files from external parties, such as email attachments, downloads and shared drives.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GStreamer Security Advisory 2026-0090 gstreamer.freedesktop.org
- GStreamer merge request 12647 (fix) gitlab.freedesktop.org
- GStreamer Security Center gstreamer.freedesktop.org
- SUSE CVE entry vulners.com
- OpenCVE entry app.opencve.io
- VulDB entry (disputed CVSS and CWE) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:16.
Original description (NVD)
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.