A vulnerability in GStreamer's gst-plugins-bad H.266/VVC parser allows a crafted malformed media file or stream to trigger an integer overflow during parsing of profile, tier, and level fields. This overflow can lead to a stack-based buffer overflow, potentially causing application crashes or enabling code execution with the application's privileges. The flaw affects certain versions of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 10.2.z, 10.3.z, 10.4, RHIVOS 2.1 and 2.1-core, and Fedora 43. No complete mitigation or fix is currently available, and users are advised to disable H.266/VVC media ingestion or avoid processing untrusted H.266/VVC content until patched.