The vulnerability arises from a heap-based buffer overflow in the GStreamer JPEG parser when it processes Huffman tables. The flaw is caused by inadequate validation of the length of user-supplied data before copying it into a fixed-size heap buffer. An attacker can craft a malicious JPEG stream to overflow the buffer, allowing execution of arbitrary code in the context of the running process. This presents a classic remote code execution attack surface and could also lead to denial‑of‑service if the overflow triggers a crash.

The flaw affects installations of GStreamer. No specific version ranges are listed in the available data; therefore, any deployment running GStreamer could be vulnerable until a patch is applied. The CPE string for the affected product is cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*:.

The CVSS score of 7.8 indicates a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to supply a malicious JPEG stream to a GStreamer-enabled application; the vector is likely local or remote depending on how the application accepts input. While exploitation requires a crafted file, the potential impact (arbitrary code execution) makes this a critical risk for exposed services.