A stack buffer overflow flaw exists in the GStreamer H.265 codec parser library (gst-plugins-bad). When processing a buffering period SEI message, the parser incorrectly uses a loop bound derived from cpb_cnt_minus1[i] instead of the intended sub‑layer 0 CPB count cpb_cnt_minus1[0] from the referenced Sequence Parameter Set. This mismatch allows a crafted H.265 video file or stream to write beyond the bounds of stack‑allocated CPB delay arrays, causing a crash or potentially corrupting stack memory, which could lead to arbitrary code execution.

The vulnerability affects Red Hat Enterprise Linux 10, 7, 8, and 9, where the gstreamer1-plugins-bad-free package is installed. Specific version information is not provided, so all installed instances of this package on the mentioned RHEL releases are potentially impacted.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker supplying a malicious H.265 media stream or file to an application that uses GStreamer with the gst-plugins-bad package on a vulnerable RHEL system. Exploitation would require local or remote access to trigger the parser, and successful exploitation could result in stack memory corruption and code execution.