The vulnerability resides in GStreamer's gst‑plugins‑bad H.265 video parser. A malicious H.265 file with a malformed Screen Content Coding extension triggers an integer underflow in bounds calculation, allowing the parser to write beyond the fixed‑size array and causing memory corruption. The direct result is a crash, delivering a denial‑of‑service effect to the impacted application.

This flaw affects the Red Hat Enterprise Linux operating system families (versions 10, 7, 8, and 9) through the bundled gst‑plugins‑bad library. The exact version that includes the vulnerability is not listed in the provided data, but any deployment utilizing the affected parser is at risk until the vendor releases an update.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, so the likelihood of exploitation is unclear, and the vulnerability is not yet catalogued in CISA's KEV list. Exploitation requires the attacker to supply a crafted H.265 media file to the vulnerable application; it cannot be triggered remotely without access to the file stream. The impact is limited to denial of service, with no evidence of code execution or data disclosure.