CVE-2026-52722

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

This is an Important signed integer overflow vulnerability in the GStreamer VMnc decoder (gst-plugins-bad). The flaw allows out-of-bounds heap reads when processing specially crafted VMnc video files due to signed integer overflow in cursor payload size arithmetic that bypasses a length check. A tiny buffer is allocated based on the overflowed value, but the rendering loop uses the original large dimensions, reading far beyond the allocated memory. The impact affects both availability (crash) and potentially confidentiality (information disclosure from heap memory reads). Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted VMnc video content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.