The vulnerability arises from an inability of the FLV media demuxer within GStreamer gst-plugins-good to validate buffer sizes and data availability for enhanced audio and video tags in malformed or truncated streams. This oversight can trigger an assertion failure or crash, resulting in denial of service for applications that process such media. The weakness corresponds to CWE-617—Bad Input Handling.

Affected vendors and products include the GStreamer project’s gst-plugins-good component, and several Red Hat Enterprise Linux releases (10, 7, 8, 9). No specific version ranges are listed in the CNA data, so all versions of these products remain potentially vulnerable until a patch is applied. The CPE strings confirm these distributions.

The CVSS score is 6.5, indicating a moderate severity. Exploitation requires only the delivery of a crafted FLV file; no special credentials are needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Because the flaw leads to a crash, its impact is limited to denial of service rather than remote code execution.