GStreamer Editing Services (GES) allows a project file to contain an arbitrary GStreamer pipeline definition. When such a file is opened, the pipeline is parsed without restrictions on which elements may be used or which properties may be set. This permits a malicious pipeline to perform arbitrary local file reads, file writes, outbound network requests, or cause the application to crash. Under certain conditions the file‑write capability can be leveraged for code execution, potentially compromising the host system.

The vulnerability affects the GStreamer project's gst-editing-services component. Any installation that accepts GES project files and uses GStreamer autoplugging is potentially vulnerable. No explicit version qualifiers are listed, so all released versions containing this component remain affected until the patch is applied.

The CVSS score of 7.8 indicates high severity. The probability of exploitation is not quantified, but the vulnerability can be triggered by a crafted GES project file that a remote attacker can deliver, for example through a malicious download or by tricking a user into opening a file. Because the flaw permits arbitrary local file access and outbound connections, a successful exploitation could lead to remote code execution or privilege escalation. No publicly known exploits have been documented, yet the potential for serious impact persists.