The vulnerability in GStreamer’s AV1 parser causes a byte/bit confusion when passing a byte count to a bit-reader API, leading to parser desynchronization and an assertion abort that crashes the application. An attacker can remotely deliver a specially crafted AV1 media file to trick a user into opening it, resulting in a denial of service for the affected application.

Red Hat Enterprise Linux 6 through 10 are impacted by GStreamer 1.x packages in the gst-plugins-bad suite. Users running any of these distributions should verify whether the affected gstreamer library is present on their systems.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 percent reflects a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user tricking a victim into opening a malicious AV1 file; the absence of a practical workaround means exploitation would require the file to be processed by the vulnerable parser, leading to a crash.