CVE catalog

CVE-2026-116612

gstreamer-editing-services1.0: CVE-2026-116612

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.23% · Oct 27, 2026

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangstreamer-editing-services1.0sid1.28.8-1fixed
Debiangstreamer-editing-services1.0forky1.28.8-1fixed
Debiangstreamer-editing-services1.0trixie1.26.2-1vulnerable
Debiangstreamer-editing-services1.0bookworm1.22.0-2vulnerable
Ubuntugstreamer-editing-services1.016.041.4.0-2vulnerable
Ubuntugstreamer-editing-services1.016.041.6.0-1vulnerable
Ubuntugstreamer-editing-services1.016.041.6.1-1vulnerable
Ubuntugstreamer-editing-services1.016.041.6.2-1vulnerable
Ubuntugstreamer-editing-services1.018.041.12.3-1vulnerable
Ubuntugstreamer-editing-services1.018.041.12.4-1vulnerable
Ubuntugstreamer-editing-services1.018.041.13.1-1vulnerable
Ubuntugstreamer-editing-services1.018.041.13.91-1vulnerable
Ubuntugstreamer-editing-services1.018.041.14.0-1vulnerable
Ubuntugstreamer-editing-services1.018.041.14.1-1~ubuntu18.04.1vulnerable
Ubuntugstreamer-editing-services1.018.041.14.4-1~ubuntu18.04.1vulnerable
Ubuntugstreamer-editing-services1.018.041.14.5-0ubuntu1~18.04.1vulnerable
Ubuntugstreamer-editing-services1.020.041.16.1-1vulnerable
Ubuntugstreamer-editing-services1.020.041.16.2-2vulnerable
Ubuntugstreamer-editing-services1.022.041.18.5-1vulnerable
Ubuntugstreamer-editing-services1.022.041.18.5-1build2vulnerable
Ubuntugstreamer-editing-services1.022.041.18.5-1build3vulnerable
Ubuntugstreamer-editing-services1.022.041.20.0-1vulnerable
Ubuntugstreamer-editing-services1.022.041.20.0-2vulnerable
Ubuntugstreamer-editing-services1.022.041.20.1-1vulnerable
Ubuntugstreamer-editing-services1.022.041.20.1-2vulnerable
Ubuntugstreamer-editing-services1.024.041.22.0-2vulnerable
Ubuntugstreamer-editing-services1.024.041.22.8-1vulnerable
Ubuntugstreamer-editing-services1.024.041.24.1-1vulnerable
Ubuntugstreamer-editing-services1.024.041.24.1-1build1vulnerable
Ubuntugstreamer-editing-services1.024.041.24.2-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.2-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.3-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.4-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.5-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.6-1vulnerable
Ubuntugstreamer-editing-services1.026.101.28.7-1vulnerable
Ubuntugstreamer-editing-services1.026.041.26.6-1vulnerable
Ubuntugstreamer-editing-services1.026.041.27.2-1vulnerable
Ubuntugstreamer-editing-services1.026.041.27.90-1vulnerable
Ubuntugstreamer-editing-services1.026.041.27.90-1build1vulnerable
Ubuntugstreamer-editing-services1.026.041.28.0-1vulnerable
Ubuntugstreamer-editing-services1.026.041.28.1-1vulnerable
Ubuntugstreamer-editing-services1.026.041.28.2-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangstreamer-editing-services1.0sourcesid1.28.8-1not yet assignedNot reportedNot reported
Debiangstreamer-editing-services1.0sourceforky1.28.8-1not yet assignedNot reportedNot reported
Debiangstreamer-editing-services1.0sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangstreamer-editing-services1.0sourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ges1.0-tools]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.22.0-2 · amd64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

    • 1.22.0-2 · arm64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

  • [gir1.2-ges-1.0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.22.0-2 · amd64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

    • 1.22.0-2 · arm64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

  • [libges-1.0-0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.22.0-2 · amd64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

    • 1.22.0-2 · arm64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

  • [libges-1.0-dev]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.22.0-2 · amd64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

    • 1.22.0-2 · arm64 · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

  • [python3-ges-1.0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.22.0-2 · all · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

    • 1.22.0-2 · all · bookworm

      Affected

      dsa · gstreamer-editing-services1.0 · debian · bookworm; dsa · gstreamer-editing-services1.0 · debian · 12

[Debian 13 (Trixie)]

  • [ges1.0-tools]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.26.2-1 · amd64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

    • 1.26.2-1 · arm64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

  • [gir1.2-ges-1.0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.26.2-1 · amd64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

    • 1.26.2-1 · arm64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

  • [libges-1.0-0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.26.2-1 · amd64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

    • 1.26.2-1 · arm64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

  • [libges-1.0-dev]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.26.2-1 · amd64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

    • 1.26.2-1 · arm64 · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

  • [python3-ges-1.0]Affected

    Source package: [gstreamer-editing-services1.0]

    Details (2)

    • 1.26.2-1 · all · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

    • 1.26.2-1 · all · trixie

      Affected

      dsa · gstreamer-editing-services1.0 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]