The vulnerability is a heap‑based buffer overflow that occurs when GStreamer parses MRF files. The parser fails to validate the length of user‑supplied data before copying it into a heap buffer, allowing an attacker to overwrite adjacent memory and execute code. Because the flaw is triggered by processing a crafted MRF file, remote code execution can be achieved when a user opens a malicious file or visits a malicious page that serves one.

The issue affects the GStreamer framework. No specific version ranges were provided in the advisory; all installations that use the unpatched MRF parser may be vulnerable until a corrected release is applied. Users of current GStreamer distributions should verify that their packages include the security update described in the vendor advisory.

The CVSS score of 7.8 indicates high severity, and the EPSS score of <1% shows a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation is not yet documented. Because user interaction is required, the risk to an automated environment remains lower, but any user‑actionable flow that allows opening unknown MRF files presents an opportunity for an attacker to gain execution rights.