CVE-2016-9446
gstreamer-plugins-bad-free: Missing initialization of allocated heap memory leads to information leak
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 15, 2016
Updated · March 18, 2026
Description
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-456 · Missing Initialization of a Variable