CVE-2025-6663

CVE-2025-6663 is a high-severity stack-based buffer overflow vulnerability affecting GStreamer, specifically within its H266 codec parsing. This flaw allows remote attackers to achieve arbitrary code execution by crafting malicious H266 sei messages, exploiting a lack of proper length validation before copying user-supplied data into a fixed-length buffer. The attack requires user interaction, likely through processing a malformed media file, and has a CVSS score of 7.8. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.