The flaw occurs when the PJMEDIA AVI parser copies the size of a video chunk into a frame buffer whose capacity is derived from declared media dimensions. An attacker can craft an AVI file with an oversized length field, causing an out‑of‑bounds write on the heap. This results in a classic heap buffer overflow (CWE‑122) and can lead to arbitrary memory corruption, potentially crashing the application or allowing an attacker to gain additional privileges. No fix is available for the affected releases, so the defect remains active.

Applications built with pjproject 2.17 or earlier are affected. Any system that links to these versions and processes AVI files, particularly untrusted files, is at risk. This includes media players, VoIP, or other multimedia services that use pjproject for AVI handling.

The CVSS score of 6.9 indicates a medium severity incident. EPSS data is not available, so exploit probability is unquantified. The vulnerability is not listed as a known exploited vulnerability in CISA KEV. The likely attack vector is the execution of an attacker‑crafted AVI file—either locally or sent through a remote interface that accepts such media. In production builds, the safety assertion is disabled, so the flaw is active and can be exploited when the crafted file is parsed, leading to a memory‑corruption condition that could be leveraged for denial of service or escalated attacks.