An out-of-bounds read vulnerability exists in the Linux kernel media subsystem. The stateless HEVC decoder reads integer values from the num_tile_columns_minus1 and num_tile_rows_minus1 arrays and uses them as loop bounds during tile processing. The std_validate_compound() routine does not enforce an upper limit on these u8 counts, allowing malicious input to specify tile counts that exceed the allocated array size. When such a control is supplied, the decoder will read beyond the array bounds, potentially exposing kernel memory or causing a crash. The weaknesses involved include uncontrolled buffer over-read and lack of input validation.

The vulnerability applies to the Linux kernel’s v4l2-ctrls media subsystem in any kernel version that still contains the unpatched stateless HEVC decoder. All kernel releases are potentially affected unless mitigated by an updated kernel package, as indicated by the CPE entry.

The CVSS score of 7.8 indicates a high severity level, while the EPSS score of <1% shows a very low current exploitation likelihood. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local or privileged attacker able to supply a crafted HEVC stream to a V4L2 consumer; remote exploitation is not documented and would be limited by existing media framework access controls.