A flaw exists in the GStreamer gst‑plugins‑bad package. The H.266 (VVC) parser performs an out‑of‑bounds read of up to 8 bytes from adjacent memory when it encounters a crafted aspect ratio indicator in a malformed video stream. This allows an attacker to craft a malicious H.266 video file or stream that, when processed by a GStreamer‑based application, can leak limited memory contents through video metadata, potentially exposing sensitive information from the application’s address space. The weakness is classified as CWE‑125.

The vulnerability is present in Red Hat Enterprise Linux 10, 9, and 8 distributions that include the GStreamer gst‑plugins‑bad package. The data does not specify a precise affected version range; this absence is inferred, and it is safest to assume that all currently available package releases that have not been updated with a known fix may be vulnerable.

The CVSS score of 4.3 indicates a medium severity impact focused on confidentiality. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Likely exploits would require a malicious H.266 video file or stream to be processed by a GStreamer‑based application, implying a local or source‑trusted attack vector. The exploit reads up to 8 bytes of adjacent memory, providing only a very limited data leak and no code execution or broader system compromise. Given the lack of an immediately available patch, the risk remains moderate until remediation is applied.