The flaw in the H.264 video parser of gst-plugins-bad allows a NULL pointer dereference when a specially crafted Multiview (MVC) Sequence Parameter Set is processed. This leads to the application that uses GStreamer crashing during cleanup of partially allocated structures, resulting in a denial of service. The weakness is identified as a null pointer dereference (CWE-476).

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10. No additional version information is available from the CNA data, so any installation of these operating systems that employs the affected GStreamer package is potentially impacted.

The CVSS score of 5.5 classifies the vulnerability as medium severity, with no exploit probability data available. The attack is likely to be local or remote if the vulnerable GStreamer component processes externally supplied video files; however, the description does not explicitly state the attack vector, so it is inferred that an attacker would need to supply a malicious video stream to the application. The vulnerability does not provide an attacker any direct compromise capability beyond causing a crash, and it is not listed in the CISA KEV catalog.