The vulnerability is a stack‑based buffer overflow in GStreamer’s H.266 codec parser. It occurs because the parser fails to validate the length of user‑supplied data before copying it into a fixed‑size stack buffer. When triggered, this flaw can lead to arbitrary code execution in the context of the process that has loaded GStreamer. The weakness corresponds to CWE‑120 (Buffer Copy without Checking Size) and CWE‑121 (Stack‑Based Buffer Overrun).

The affected product is GStreamer from the GStreamer supplier. No specific version numbers are provided by the CNA; the advisory references commit 2ffdfca2df95a7f605c922d3111e5d5be5314dca. Consequently, any GStreamer release that includes the unpatched H.266 parser—likely versions after the referenced commit—could be vulnerable. Users should verify whether their installed GStreamer matches the commit or check for an applicable patch.

The CVSS score is 7.8, indicating a high severity impact. The EPSS score is reported as less than 1 %, suggesting that exploitation is currently rare, but it is not impossible. This vulnerability is not listed in the CISA KEV catalog. Attackers must interact with the vulnerable library, and the description implies that an attacker can supply malicious media content. The exact remote vector is inferred from the phrase "Interaction with this library is required to exploit" rather than explicitly stated in the data.