The vulnerability is a stack-based buffer overflow in the GStreamer gst-plugins-bad H.266/VVC parser. An integer overflow occurs while parsing profile, tier, and level fields of a malformed H.266 media file or stream. This overflow can corrupt the stack, leading to crashes or potentially allowing an attacker to execute arbitrary code in the context of the affected GStreamer application.

Affected systems include Red Hat Enterprise Linux releases 7 through 10 that ship the gst-plugins-bad bad‑free package. Any application that uses GStreamer to ingest or transcode H.266/VVC media on these platforms is at risk. The specific version numbers of the affected plugin are not listed in the advisory, so all current releases of the bad‑free plugins on RHEL 7‑10 are potentially impacted.

The CVSS score of 7.8 indicates high impact while the EPSS score is not available and the vulnerability is not currently listed in CISA KEV. The likely attack vector is the introduction of a malicious H.266 file or stream into a GStreamer‑based application, either from a remote source or a local privileged user. If exploited, the attacker could cause a denial of service or execute code with the privileges of the running process. Until a patch is released, disabling VVC ingestion is the only recommended mitigations.