An out‑of‑bounds write was discovered in GStreamer’s H.266 codec parser library. The flaw occurs in the DCI parsing function when a reserved field value is incorrectly accepted, allowing the parser to write beyond the bounds of an internal structure. This vulnerability falls under CWE‑787 and can result in memory corruption, potentially causing an application crash or unstable state. The exploitation requires a specially crafted H.266 bitstream that is processed by a third‑party application using the library API. No standard GStreamer pipeline element currently triggers the affected code path, so the impact is limited to applications that directly invoke the parser.

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9 are impacted. Affected patch versions are not specified in the advisory, so any package containing the unpatched GStreamer libraries on those releases is considered vulnerable.

The CVSS score of 6.5 indicates a medium severity, and the EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker supplying a crafted H.266 stream to a vulnerable application that loads the affected library; this is inferred from the description that the flaw is exploited by providing a specially crafted bitstream. The risk is primarily a denial‑of‑service or unstable state rather than arbitrary code execution, but the memory corruption could serve as a stepping stone for further exploitation if privileges are elevated.