An integer overflow occurs in the AV1 LEB128 variable‑length integer parser in GStreamer, which enables a remote attacker to craft a malformed AV1 bitstream that triggers a crash when processed by applications that load the plugin. The vulnerability results in a denial of service as the process terminates unexpectedly, potentially affecting system availability for end users.

The flaw affects all supported releases of Red Hat Enterprise Linux from version 6 through version 10, because the GStreamer libraries that include the AV1 decoder are bundled with these operating systems. Any application running on these systems that uses the GStreamer plugin set can be impacted if it processes AV1 media.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is currently unavailable, so the likelihood of widespread exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog, and there is no publicly disclosed exploit at the time of this analysis. Based on the description, the likely attack vector is remote via an attacker-supplied AV1 file or stream that is parsed by the affected application. Because the flaw arises from an integer overflow during parsing, local privilege escalation or code execution are not enabled by the current description.