The vulnerability arises in GStreamer’s wavparse ADTL chunk parser, where a size validation check was added but fails to account for a rounding operation used in offset calculation. When the length field contains an odd number, the parser advances beyond the validated boundary, resulting in an out‑of‑bounds read that could expose data stored adjacent to the buffer. The flaw could lead to the disclosure of confidential information but does not provide control or denial‑of‑service capabilities.

Red Hat Enterprise Linux ships the GStreamer library in its core repositories. Versions 6 through 10 contain the affected implementation. Systems running any of these distributions and relying on the bundled GStreamer binaries are susceptible until they receive the fully corrected package.

The CVSS base score of 5.1 places the issue in the medium severity range, and the current EPSS estimate is below 1 %. It is not recorded in the CISA Known Exploited Vulnerabilities catalogue, indicating no widespread or confirmed public exploitation. Based on the technical description, a likely attack vector would involve a remote attacker supplying a crafted WAV file to an application that parses media using GStreamer. The impact would be limited to information disclosure rather than code execution or denial of service, but monitoring for anomalous reads remains prudent.