EUVD-2026-42569
GHSA-g4ff-54hw-hj6r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Victim's client must connect out to a malicious server (UI:R, AV:N, PR:N); confirmed impact is process crash (A:H) with limited/uncertain integrity impact (I:L) and no confidentiality loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
AnalysisAI
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
Technical ContextAI
GStreamer is the dominant open-source multimedia framework on Linux, used for pipeline-based media capture, decoding and streaming. The affected component is the rfbsrc element (part of gst-plugins-bad), which acts as a VNC/RFB client source, pulling remote framebuffer data into a GStreamer pipeline. The RFB protocol's Hextile encoding compresses rectangles by tiling them and applying background/foreground fills. The root cause is CWE-787 (Out-of-bounds Write): a pixel-size type mismatch where the Hextile background-fill routine emits 32-bit pixel values into a heap buffer that was allocated assuming the server-advertised 16-bit-per-pixel format, so each fill overruns the allocation.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the GStreamer update once your distribution ships it, tracking the upstream fix at https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/100 and, for Red Hat systems, the errata linked from https://access.redhat.com/security/cve/CVE-2026-59691 and https://bugzilla.redhat.com/show_bug.cgi?id=2497343. Until a patched build is installed, the concrete compensating control is to avoid using the rfbsrc element to connect to untrusted or attacker-controllable VNC/RFB servers; if you operate GStreamer pipelines that use rfbsrc, restrict them to known-trusted VNC endpoints, or disable/remove the rfbsrc plugin from gst-plugins-bad if it is not needed (side effect: any pipeline relying on VNC ingestion will stop functioning). Where feasible, run media pipelines under a sandbox or with hardened heap allocators to blunt the impact of the out-of-bounds write.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today