Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attacker stands up malicious VNC server
  2. Delivery
    Lures victim to connect via rfb:// URI
  3. Exploit
    Sends FramebufferUpdate with oversized rectangle
  4. Install
    Bypasses area-based bounds check
  5. C2
    Heap out-of-bounds write during pixel copy
  6. Execute
    Hijack control flow in GStreamer process
  7. Impact
    Code execution as the user

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the victim's GStreamer build includes the librfb plugin and that the user actively initiates a VNC/RFB session to an attacker-controlled server (UI:R in the CVSS vector); the attacker does not need credentials on the victim host but must coerce or trick the outbound connection. Limiting factors are the user-interaction requirement, the need for the attacker to host or proxy a reachable VNC endpoint, and that systems where the librfb plugin is not installed, loaded, or used by any media application are not exposed; no special victim-side configuration beyond having a GStreamer pipeline that instantiates rfbsrc is required.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 and accurately reflects a client-side memory-corruption flaw: network reachable, low complexity, no privileges, but requires the victim to initiate a VNC connection to the attacker's server (UI:R). There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was supplied, so real-world exploitation pressure today appears low. However, the impact class (heap RCE in a multimedia framework loaded by many media players and remote-desktop tools across all current RHEL versions) means a working exploit would be high-value, and reliable heap exploitation of librfb is plausible because the attacker controls both the trigger (rectangle geometry) and the contents written (pixel data). The principal mitigating factor is that exploitation requires luring a user into connecting to a malicious VNC server rather than passive network exposure; the principal aggravator is the breadth of the affected platform inventory.
Exploit ScenarioDerived

An attacker stands up a malicious VNC server and uses phishing or a malicious link (vnc://, a media playlist, or an embedded URI handled by a GStreamer-based application) to entice a RHEL user to connect. When the victim's client requests a framebuffer update, the server replies with a FramebufferUpdate containing a rectangle whose x/y offsets place writes outside the framebuffer while keeping width*height small enough to pass the area check, corrupting heap metadata with attacker-supplied pixel bytes and ultimately achieving code execution in the user's session or crashing the application.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a connecting client, potentially leading to remote code execution or denial of service. The flaw stems from validating rectangle area instead of individual dimensions, letting attacker-controlled rectangles extend beyond the framebuffer. No public exploit identified at time of analysis, though the issue affects GStreamer as shipped across Red Hat Enterprise Linux 6 through 10.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data; track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52720 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2486731 for the fixed gstreamer1-plugins-bad-free (or equivalent) package versions per RHEL release, and apply them via dnf/yum update once published. Until packages are available, the most direct compensating control is to avoid connecting to untrusted VNC servers and to remove or mask the librfb GStreamer plugin (for example by deleting libgstrfbsrc.so from the plugin directory or setting GST_PLUGIN_FEATURE_RANK=rfbsrc:NONE), which breaks any legitimate GStreamer-based VNC viewing but eliminates the attack surface; egress filtering of TCP/5900-5910 to non-trusted networks reduces opportunity at the cost of blocking benign remote-desktop use. SELinux confinement of media-playing processes provides marginal additional containment but will not by itself stop in-process heap corruption.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is a widely deployed multimedia framework, and its librfb plugin implements a client for the Remote Framebuffer (RFB) protocol used by VNC. When the server sends a FramebufferUpdate message, each rectangle carries x, y, width, and height fields that the client must validate against the framebuffer bounds before writing pixel data into a heap-allocated buffer. The bug, classified as CWE-122 (Heap-based Buffer Overflow), arises because librfb checks the product width*height (area) against the framebuffer area rather than verifying that x+width and y+height individually fit within the framebuffer's width and height. A rectangle with, for example, a small area but large offsets can pass the check and cause subsequent pixel writes to land outside the allocated heap region, corrupting adjacent allocator metadata or objects. The affected component is tracked upstream in freedesktop.org GitLab issue 5105 and impacts the GStreamer package shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Client connects over network to attacker VNC server (AV:N, PR:N), reliably triggered by sending a crafted rectangle (AC:L), user must initiate connection (UI:R), heap RCE yields full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.

Executive ViewAI

Why It Matters

GStreamer's VNC client library contains a buffer overflow vulnerability (CVE-2026-52720, CVSS 8.8) enabling remote code execution when connecting to a malicious VNC server, affecting Red Hat Enterprise Linux versions 6 through 10. This impacts any organization deploying GStreamer-dependent applications for media processing. The absence of a vendor patch necessitates immediate compensating controls to restrict VNC connectivity and assess system exposure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable GStreamer services and remove the package if media processing is not operationally required; (2) Restrict network access to VNC servers through firewall rules and application-layer controls; (3) Run GStreamer-dependent applications in restricted/sandboxed environments with reduced privilege levels; (4) Implement host-based intrusion detection focused on heap corruption patterns and unexpected process behavior on affected systems; (5) Restrict administrative access to systems where GStreamer cannot be removed.

Threat Intelligence Overview

EPSS Score
0.5%
Top 62% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52720 ADVISORY https://vuldb.com/vuln/371227 REF https://access.redhat.com/errata/RHSA-2026:36749 REF https://access.redhat.com/errata/RHSA-2026:36834 REF https://access.redhat.com/errata/RHSA-2026:37130 REF https://access.redhat.com/errata/RHSA-2026:47069 REF https://access.redhat.com/errata/RHSA-2026:47070 REF https://access.redhat.com/errata/RHSA-2026:47071 REF https://access.redhat.com/errata/RHSA-2026:47075 REF https://access.redhat.com/errata/RHSA-2026:47076 REF https://access.redhat.com/errata/RHSA-2026:47176 REF https://access.redhat.com/errata/RHSA-2026:47717 REF https://access.redhat.com/errata/RHSA-2026:47718 REF https://access.redhat.com/errata/RHSA-2026:49517 REF https://access.redhat.com/security/cve/CVE-2026-52720 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486731 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52720.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy