CVE-2026-52720

A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.

This is an Important heap buffer overflow vulnerability in GStreamer's librfb RFB/VNC client (gst-plugins-bad). The flaw allows a controlled out-of-bounds heap write when connecting to a malicious VNC server due to an incorrect bounds check that validates rectangle area instead of individual dimensions. The impact affects availability (crash), integrity, and potentially confidentiality, as the controlled heap overflow could be leveraged for code execution. Red Hat products utilizing GStreamer for multimedia processing are affected if they include the rfbsrc element for VNC/RFB screen capture pipelines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.