GStreamer Editing Services EUVD-2026-109997

Exploitation requires an attacker to deliver a crafted GES (GStreamer Editing Services) project file that embeds an arbitrary GStreamer pipeline description inside an effect definition, and requires that file to be processed on the victim's host. Processing happens either explicitly, when a user loads the project in a GES-based editing application, or implicitly, when a media player or file-manager thumbnailing service that uses GStreamer autoplugging opens the file. The core precondition is that GES parses and instantiates the embedded pipeline with no allowlist on which elements may be used or which properties may be set (CWE-913), enabling file-reading/writing elements and network-source elements. Limiting factors per the CVSS vector: the vector is local (AV:L) and requires user or application interaction (UI:R) - the file must reach the system and be opened or auto-processed; there is no listening network service to attack directly. The autoplugging/thumbnailing path materially lowers the interaction requirement because no deliberate user open is needed. Fixed in gst-editing-services 1.28.8; the vendor provides the fix via the update - no separate workaround is stated in the available sources.

This is a genuine, actionable priority rather than an inflated high-CVSS score, and the vendor priority label 'this_week' aligns with that. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a low-complexity, unauthenticated attack that nonetheless requires user interaction and a local attack vector - meaning the attacker does not exploit a listening service but must get a crafted file onto the victim's system and have it loaded. The description characterizes the attacker as 'remote' (someone who delivers a file), which is the classic malicious-file pattern and is consistent with AV:L/UI:R; there is no true network-service exposure, so do not read AV:L as remotely reachable. The design flaw (CWE-913, unrestricted instantiation of an embedded GStreamer pipeline) cleanly supports the C:H/I:H/A:H impact: arbitrary local file read, arbitrary file write, outbound network requests, and crashes, with code execution possible under certain conditions. EPSS probability is not supplied, the CVE is NOT in CISA KEV, and no public exploit or PoC reference is provided - only a vendor advisory and the fix merge request. Therefore exploitation is unproven in the wild; the 'RCE' tag reflects the vendor's 'under certain conditions' caveat, not a demonstrated, reliable exploit. The meaningful risk amplifier is that exploitation can be triggered automatically by media players or file-manager thumbnailing services that use GStreamer autoplugging, which substantially weakens the UI:R barrier in real desktop deployments.

An attacker emails or hosts a crafted GES (.xges) project file embedding a malicious GStreamer pipeline description as an effect definition. When the victim opens it in an editing application - or merely when a file manager or media player auto-generates a thumbnail via GStreamer autoplugging - the embedded pipeline is instantiated with unrestricted elements, letting the attacker read or write arbitrary local files or make outbound requests to their server. No public exploit code is identified at time of analysis, though the vendor notes file-write may be leveraged for code execution; the low attack complexity (AC:L) makes crafting such a file straightforward.