A stack-based buffer overflow exists in GStreamer’s qtdemux component when parsing UncompressedFrameConfigBox structures. The buffer lacks proper validation of the length field, allowing an attacker to overflow a fixed-length stack buffer and execute arbitrary code in the context of the running process. The vulnerability is a classic memory corruption flaw (CWE-121). Interaction with the library is required for exploitation, and the actual attack vector may differ depending on the implementation.

All installations of GStreamer are potentially affected, as the issue is located in the core qtdemux module. No specific version range is listed in the advisory, so any GStreamer build that includes the vulnerable parsing logic is at risk.

The CVSS score of 7.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires an attacker to supply crafted data to the library, typically through a media file parsed by a GStreamer‑enabled application. The lack of input validation directly leads to the overflow and remote code execution.