Is CVE-2026-116612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116612 being exploited in the wild.

How severe is CVE-2026-116612?

High severity, with a CVSS score of 7.8, published 26 October 2026.

Is there a fix for CVE-2026-116612?

Yes: fixed in GStreamer 1.28.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116612 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116612?

Check whether you run Gstreamer Editing Services. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116612: GStreamer Editing Services unsafe GES project parsing

CVE-2026-116612 · Severity: high · CVSS 7.8 · Published 2026-10-26

GStreamer Editing Services is a multimedia framework component used by video editing applications, media players, and file managers to handle media files. A crafted GES project file can embed malicious GStreamer pipeline descriptions that execute unrestricted commands when loaded, allowing an attacker to read/write arbitrary files, make network requests, crash the application, or potentially execute code. The vulnerability affects any application that automatically or manually opens GES project files.

Vendors: Gstreamer.

Quick answers

Is CVE-2026-116612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116612 being exploited in the wild.
How severe is CVE-2026-116612?: High severity, with a CVSS score of 7.8, published 26 October 2026.
Which products and versions are affected?: GStreamer Editing Services.
Is there a fix for CVE-2026-116612?: Yes: fixed in GStreamer 1.28.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116612 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116612?: Check whether you run Gstreamer Editing Services. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GStreamer 1.28.8

Technical details

The vulnerability is an improper input validation issue in GStreamer Editing Services (gst-editing-services) where GES project files can embed arbitrary GStreamer pipeline descriptions without restriction on which elements or properties are allowed. When a project file is loaded—either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service—the pipeline description is parsed and instantiated without proper sandboxing, allowing attackers to trigger file read/write operations, outbound network requests, application crashes, or code execution. The fix restricts which elements and properties are considered "trusted" when loading untrusted project files.

Affected products

GStreamer Editing Services

Timeline

2026-10-26: disclosed
2026-10-08: patched: GStreamer 1.28.8 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.