An out‑of‑bounds read occurs in the VA JPEG decoder component of GStreamer’s gst‑plugins‑bad. The parser accepts a segment length field from the JPEG stream without ensuring that the declared length fits within the remaining input, which allows a maliciously crafted JPEG file to force the decoder to read past the end of the supplied buffer. This can cause the application to crash or expose memory contents to the attacker, a behavior classified as CWE‑125 and representing an information disclosure vulnerability that can be triggered by local execution of a compromised image.

The vulnerability impacts the GStreamer gst‑plugins‑bad package bundled with Red Hat Enterprise Linux versions 6 through 10. The CNA advisory lists these operating systems as affected; no specific product or version qualifiers are supplied beyond the distro level, indicating that any installation of the gst‑plugins‑bad plugin set containing the vulnerable VA JPEG decoder is potentially exposed.

The CVSS score of 7.1 indicates a high severity level, while the EPSS value of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not cataloged in CISA’s KEV list. An attacker would need to deliver the crafted JPEG to the target user, implying the attack vector is local or compromised media handling. No practical workaround is available from Red Hat; therefore the prescribed mitigation is to apply the forthcoming security update or otherwise prevent use of the vulnerable decoder.