{"schema":"threatline.record/2","record":{"id":"CVE-2026-116612","aliases":[],"summary":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, eit","details":"A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.","categories":["Unclassified"],"product":"gst-editing-services","vendor":"GStreamer project","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116612","source_modified_at":"2026-10-26T17:37:09.227Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"gst-editing-services","vendor":"GStreamer project","versions":[{"version":"0","lessThan":"1.28.8","versionType":"semver","status":"affected"},{"version":"1.28.8","status":"unaffected"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116612","source_modified_at":"2026-10-26T17:37:09.227Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"gst-editing-services","ecosystem":null},"version":"1.28.8","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T16:48:37.293Z","modified_at":"2026-10-26T17:37:09.227Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116612","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T17:37:09.227Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://gstreamer.freedesktop.org/security/sa-2026-0090.html","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12647","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-26T17:22:48.922274Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T17:37:09.227Z","content_hash":"b69e440be01b39d406223b90823063fa80f4141f2a7cf3710d2c374af8fbaa59"}}