GStreamer’s H.266 codec parser contains an out‑of‑bounds write flaw (CWE‑787). The vulnerability allows an attacker to write data past the end of a buffer while parsing APS units, leading to arbitrary code execution in the context of the current process. The vendor notes that this flaw results from a lack of proper validation of user‑supplied data and that an attacker can leverage it to execute code.

Affected software is the GStreamer multimedia framework. No specific version information is provided in the available data, so all installations that use the H.266 parser may be impacted until a patch is applied.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 % indicates a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires an application that processes H.266 streams to provide crafted data to the parser; thus the vector is indirect and depends on the context in which GStreamer is used. As no official workaround is published, organizations should treat this as a vulnerability that can be mitigated by updating the affected component.