It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions. It can be leveraged in an exploit chain to compromise a system.

I'm not a Google fan, but if the maintainers are unable to understand that, I welcome a fork.