The vulnerability is a race condition in the VideoRoom plugin of Janus Gateway up to version 1.4.2. Exploitation is triggered remotely by manipulating internal state timing in src/plugins/janus_videoroom.c. Because the race condition can be controlled from outside the system, an attacker can potentially execute arbitrary code or cause undesired behavior on the server. The description indicates that remote exploitation is possible, the attack complexity is high, and the exploitability is difficult but public code is available.

The affected product is meetecho Janus Gateway and its VideoRoom plugin, for all releases up to 1.4.2. No specific minor version notes are provided beyond that cutoff, so any build of Janus Gateway containing the unpatched VideoRoom plugin is vulnerable.

The CVSS score of 2.3 reflects a low overall severity, and there is no EPSS score or KEV listing, so the likelihood of widespread exploitation is low at present. However, because a public exploit exists and the vulnerability allows remote code execution, it is still a potential threat if the application is exposed to the internet. Attackers would need to orchestrate precise timing conditions, making discovery harder, but once discovered the impact could be significant.