The vulnerability described occurs in the parsing of picture partitions within the GStreamer H.266 codec parser and leads to an integer underflow before memory writes. Key detail from vendor description: the flaw arises from insufficient validation of user‑supplied data, ultimately permitting an attacker to execute arbitrary code in the context of the running process. This results in full compromise of confidentiality, integrity, and availability of the process that loads the library.

Affected vendor is GStreamer. The affected product is GStreamer itself; specific version information is not supplied in the CNA data. Users of any GStreamer installation that processes H.266 encoded video streams and otherwise depends on GStreamer’s H.266 parsing capabilities are potentially impacted.

The CVSS score of 7.8 indicates a high severity. The EPSS score is reported as less than 1%, indicating a low probability of observed exploitation in the wild. It is not listed under CISA’s KEV catalog. Based on the description, the likely attack vector requires an attacker to supply crafted H.266 compliant data that is parsed by GStreamer, implying that remote vectors such as network streams, file uploads, or multimedia playback could be used. The vulnerability is exploitable when the library is invoked and the attacker can influence the parsing of picture partitions.