This vulnerability in Red Hat Enterprise Linux 10 affects the GStreamer AV1 codec parser in gst-plugins-bad. The function gst_av1_parser_parse_tile_list_obu() passes a byte count where a bit count is expected by the bit-reader API, leading to parser desynchronization. This flaw can be triggered remotely by opening a maliciously crafted AV1 media file, causing an assertion failure that results in an application crash (denial of service). The CVSS 3.1 base score is 6.5 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, and impact limited to availability.

Successful exploitation causes an application crash due to an assertion abort, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability requires user interaction (opening a crafted media file) and can be exploited remotely over the network.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52718 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should avoid opening untrusted AV1 media files until a patch or mitigation is available.