The vulnerability resides in GStreamer's MicroDVD subtitle parser, where a null pointer dereference can occur when processing a specially crafted subtitle file. This flaw leads to the application crashing, resulting in a denial of service condition. The weakness is identified as CWE-476, indicating improper handling of null references.

Red Hat Enterprise Linux releases from version 6 through 10, which ship with the gst‑plugins‑base component of GStreamer, are affected. Any systems that use these distros and have GStreamer's MicroDVD subtitle parser enabled for handling .sub files are potentially vulnerable.

Based on the description, it is inferred that the likely attack vector involves delivering a specially crafted MicroDVD subtitle file to the application. The CVSS score of 6.5 characterizes the flaw as of moderate severity. Although no EPSS score is provided and the vulnerability is not listed in CISA's KEV catalog, it can be triggered by an attacker supplying a malicious subtitle file, either locally or remotely if the media application accepts user‑supplied subtitles. The impact is limited to crashes and loss of availability, with no evidence of privilege escalation or data theft.