The vulnerability resides in GStreamer's handling of DVB subtitle coordinates, where improper validation of user-supplied data can lead to a write beyond the end of a buffer. This out-of-bounds write (CWE-787) enables an attacker to execute arbitrary code in the context of the current process, as stated in the vendor description. The impact is a full compromise of the application using the library, potentially affecting confidentiality, integrity, and availability of the host system.

The affected product is the GStreamer multimedia framework, with all installations that rely on the DVB subtitle component. No specific version range is provided in the data; therefore any installation that has not applied the referenced patch should be considered vulnerable.

A CVSS score of 7.8 indicates high severity. The EPSS score is less than 1%, suggesting that exploitation is currently rare or not publicly known, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring interaction with the GStreamer library (e.g., playing a crafted media stream), as the description notes that remote attackers can exploit the flaw. While the likelihood appears low, the availability of a remote code execution path warrants prompt attention.