CVE-2026-116612

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

• CWE-913

• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12647
• https://gstreamer.freedesktop.org/security/sa-2026-0090.html

Published

Oct 26, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116604A vulnerability has been found in SourceCodester Online Food…6.5
• CVE-2026-116605A vulnerability was found in SourceCodester Online Food Orde…5.3
• CVE-2026-116608A security vulnerability has been detected in DAMO Academy V…5.4
• CVE-2026-116609The WP Visitor Statistics (Real Time Traffic) plugin for Wor…6.5
• CVE-2026-11661Use after free in Views in Google Chrome on Windows prior to…8.3
• CVE-2026-116610The Clean Login plugin for WordPress is vulnerable to Missin…4.3
• CVE-2026-116613The Animated Text Block plugin for WordPress is vulnerable t…7.5
• CVE-2026-11662Type Confusion in Bindings in Google Chrome prior to 149.0.7…8.8
• CVE-2026-116620A security vulnerability has been detected in Tencent RapidJ…7.3
• CVE-2026-116623A vulnerability was detected in code-projects Simple Content…7.3
• CVE-2026-116627Improper neutralization of input during web page generation …
• CVE-2026-11663Use after free in Skia in Google Chrome prior to 149.0.7827.…8.3