CVE-2026-116612
Description
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.
Statement
Red Hat Enterprise Linux and other Red Hat products in the manifest cube do not ship the gst-editing-services package and are not affected. Fedora ships gst-editing-services; refer to the affect table for stream-specific impact.
Mitigation
Uninstall or remove the gst-editing-services package if editing functionality is not required. Alternatively, lower the rank of the gesdemux GStreamer plugin to GST_RANK_NONE (for example GST_PLUGIN_FEATURE_RANK=gesdemux:NONE) so it is not selected during autoplugging. Do not set GES_ALLOW_UNTRUSTED=1 on patched versions; it disables enforcement.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict GStreamer pipeline element instantiation and property configuration during project loading, or disable gesdemux plugin autoplugging: upgrade to gst-editing-services 1.28.8 (or the fixed Gst Editing Services builds), which refuse untrusted elements and properties when loading a project, closing all 3 injection vectors (crafted .xges project file, crafted .xptv project file, gesdemux automated thumbnailing). Until patched, this is only a concern on Systems running gst-editing-services where users open project files or desktop services automatically parse media files — Red Hat Enterprise Linux deployments are unaffected — so Uninstall gst-editing-services or set GST_PLUGIN_FEATURE_RANK=gesdemux:NONE to prevent gesdemux from being invoked by media players and thumbnailing services. As a compensating measure, Deploy EDR agents to detect anomalous outbound network connections or unauthorized file writes from media applications processing project files, Configure auditd to monitor and record unexpected file open and write system calls executed by thumbnailer or media player processes, and Use Falco or eBPF runtime security to detect anomalous outbound network traffic or sensitive file modifications originating from media parsing processes. These controls limit blast radius and contain exploitation, but they do not fix the underlying unrestricted element instantiation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1001 EDR Agent (Endpoint Detection & Response) (medium)
Acknowledgements
Upstream acknowledges Ada Logics (Ada Logics) and Claude (Anthropic) as the original reporters.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
