# CVE-2026-116612: GStreamer Editing Services unsafe GES project parsing

Source: https://junglewise.ai/threats/cve-2026-116612-a-flaw-was-found-in-gstreamer-editing-services-gst-editing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116612 · Severity: high · CVSS 7.8 · Published 2026-10-26

GStreamer Editing Services is a multimedia framework component used by video editing applications, media players, and file managers to handle media files. A crafted GES project file can embed malicious GStreamer pipeline descriptions that execute unrestricted commands when loaded, allowing an attacker to read/write arbitrary files, make network requests, crash the application, or potentially execute code. The vulnerability affects any application that automatically or manually opens GES project files.

Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-116612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116612 being exploited in the wild.

**How severe is CVE-2026-116612?** High severity, with a CVSS score of 7.8, published 26 October 2026.

**Which products and versions are affected?** GStreamer Editing Services.

**Is there a fix for CVE-2026-116612?** Yes: fixed in GStreamer 1.28.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116612 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116612?** Check whether you run Gstreamer Editing Services. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GStreamer 1.28.8

## Technical details

The vulnerability is an improper input validation issue in GStreamer Editing Services (gst-editing-services) where GES project files can embed arbitrary GStreamer pipeline descriptions without restriction on which elements or properties are allowed. When a project file is loaded—either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service—the pipeline description is parsed and instantiated without proper sandboxing, allowing attackers to trigger file read/write operations, outbound network requests, application crashes, or code execution. The fix restricts which elements and properties are considered "trusted" when loading untrusted project files.

## Affected products

- GStreamer Editing Services

## Timeline

- 2026-10-26: disclosed
- 2026-10-08: patched: GStreamer 1.28.8 released with fix

## References

- [https://gstreamer.freedesktop.org/](https://gstreamer.freedesktop.org/)
- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12647](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12647)