A heap‑based buffer overflow in GStreamer’s PNG parsing has been disclosed, allowing a malicious actor to execute arbitrary code within the context of the process that is parsing a PNG file. The vulnerability stems from improper validation of user‑supplied data length before copying it into a heap buffer and is classified under CWE‑122. If triggered, the attacker can run code as the user of the application, potentially gaining full control of the affected system.

The flaw resides in the GStreamer multimedia framework produced by the GStreamer project. All installations of GStreamer that expose PNG parsing capabilities are conceptually affected; no specific versions were enumerated in the advisory.

The CVSS base score for this vulnerability is 7.8, indicating a high severity and the potential for serious damage. Exploitation requires an attacker to either host a malicious web page that loads a crafted PNG file or supply the file directly to a user who then opens it, meaning user interaction is required. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. The combination of a high CVSS score, the need for user interaction, and the remote code execution capability places this vulnerability in a high‑risk category for any system running GStreamer without a recent patch.