Gst Editing Services
Monthly
Crafted GES project files processed by GStreamer Editing Services before 1.28.8 can embed an arbitrary GStreamer pipeline description inside an effect definition that is parsed and instantiated with no restriction on elements or properties, letting an attacker read or write arbitrary local files, force outbound requests to attacker-controlled servers, or crash the host application, with file writes potentially chained into code execution. The vulnerable component is local (AV:L) and requires the file to be opened or auto-processed (UI:R), but no privileges are needed (PR:N); the autoplugging/thumbnailing path means a media player or file-manager thumbnailer can instantiate the pipeline without a deliberate user open. No public exploit code was identified at time of analysis, and the vendor has released a fix in gst-editing-services 1.28.8; this is rated a this-week priority rather than an inflated high-CVSS item.
Crafted GES project files processed by GStreamer Editing Services before 1.28.8 can embed an arbitrary GStreamer pipeline description inside an effect definition that is parsed and instantiated with no restriction on elements or properties, letting an attacker read or write arbitrary local files, force outbound requests to attacker-controlled servers, or crash the host application, with file writes potentially chained into code execution. The vulnerable component is local (AV:L) and requires the file to be opened or auto-processed (UI:R), but no privileges are needed (PR:N); the autoplugging/thumbnailing path means a media player or file-manager thumbnailer can instantiate the pipeline without a deliberate user open. No public exploit code was identified at time of analysis, and the vendor has released a fix in gst-editing-services 1.28.8; this is rated a this-week priority rather than an inflated high-CVSS item.