Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116612

Quick assessment

Affected
GStreamer project gst-editing-services
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GStreamer 编辑服务（gst-editing-services）中发现了一个安全漏洞。GES 项目文件可以将任意 GStreamer 管道描述嵌入为效果定义。当此类文件被加载时（无论是通过编辑应用程序显式加载，还是由使用 GStreamer 自动插件功能的媒体播放器或文件管理器缩略图服务自动加载），该管道描述会被解析并实例化，且对允许使用的元素或可设置的属性没有限制。能够向受害者系统投递特制项目文件的远程攻击者，可触发对任意本地文件的读写操作、向攻击者控制的服务器发起出站网络请求，或导致应用程序崩溃。在

CVSS 7.8 · High EPSS 0.23% · P14

Affected Version Matrix 2

VendorProduct Version RangeStatus
GStreamer project gst-editing-services < 1.28.8 affected
1.28.8 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116612

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态管理代码资源的控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GStreamer project gst-editing-services 0 ~ 1.28.8 -

II. Public POCs for CVE-2026-116612

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116612

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116612 (1)

Vendor Advisories for CVE-2026-116612 (1)

IV. Related Vulnerabilities

Same weakness: CWE-913