Security Advisory 2026-0090

Details

The GStreamer Editing Services project file format allows effects to be defined by a free-form pipeline description stored in the file. When a project is loaded, this description is passed to the pipeline parser without any restriction on the elements it may name or the properties it may set, so a crafted project can instantiate arbitrary elements, including file and network elements, and direct them to attacker-controlled locations.

The problem is reachable from more than the editing applications this file format is normally associated with. A file is recognized as an editing project by its content alone, independent of its file name or extension, and the project demuxer has a rank that makes playback applications select it automatically. As a result, merely opening a crafted file in a media player, or having it thumbnailled, is enough for the crafted effects to be loaded and started.

Impact

A malicious third party could achieve remote code execution by delivering a crafted editing project file that is opened by a playback application or thumbnailing service. The same mechanism allows reading and writing arbitrary local files, issuing network requests to attacker-controlled servers, and crashing the application, resulting in a denial of service.

Solution

The gst-editing-services 1.28.8 release addresses the issue. People using older versions of GStreamer should apply the patch and recompile.

As a mitigation, installations that do not need the GStreamer Editing Services can uninstall the plugin, or the rank of its project demuxer can be lowered to NONE so that it is not selected automatically for decoding.

References

The GStreamer project

• https://gstreamer.freedesktop.org

CVE Database Entries

• No CVE number assigned or pending

GStreamer 1.28.8 release

• Release Notes
• GStreamer Editing Services 1.28.8

Patches

• Patch