This vulnerability involves a reachable assertion failure in the GStreamer AV1 codec parser (gst-plugins-bad) on Red Hat Enterprise Linux 10. The root cause is a mismatch in parameter units: a byte count is passed where a bit count is expected by the bit-reader API in the gst_av1_parser_parse_tile_list_obu() function. This causes the parser to become desynchronized and triggers an assertion abort, resulting in a denial of service via application crash. The vulnerability requires user interaction (opening a crafted AV1 media file) and does not impact confidentiality or integrity. Red Hat has issued an important security update that fixes this issue in gstreamer1-plugins-bad-free.

The vulnerability allows a remote attacker to cause a denial of service by crashing applications that use the vulnerable GStreamer AV1 codec parser when processing specially crafted AV1 media files. There is no impact on confidentiality or integrity. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

Red Hat has released an official security update that fixes this vulnerability in the gstreamer1-plugins-bad-free package. Users should apply the update to versions 10.2.4 or later to remediate the issue. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official patch.