Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host crafted VMnc file
  2. Delivery
    Deliver via web or email
  3. Exploit
    Victim opens in GStreamer player
  4. Execution
    Decoder parses oversized cursor dimensions
  5. Persist
    Signed integer overflow bypasses length check
  6. Impact
    Out-of-bounds read leaks memory or crashes process

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the victim open or otherwise cause GStreamer to decode a VMnc-format stream with attacker-controlled cursor width/height fields large enough to overflow signed integer payload-size arithmetic; the vmncdec element from gstreamer1-plugins-bad-free must be installed and loadable on the target system. The CVSS UI:R flag confirms user interaction is required - fully unattended exploitation against default RHEL servers without a desktop session is unlikely, since headless installs typically do not include the 'bad' GStreamer plugin set or auto-probing thumbnailers. Limiting factors: VMnc is an uncommon codec primarily associated with VMware screen recordings, so social-engineering plausibility is lower than for mainstream formats, and the resulting OOB read yields only C:L information disclosure plus A:H crash rather than direct code execution.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H reflects a network-reachable, low-complexity bug that nevertheless requires user interaction (opening a crafted file or stream), with high availability impact (crash) and only low confidentiality impact (information disclosure via OOB read). No EPSS score, KEV listing, or POC was provided, so the realistic risk is moderate: the bug is broadly reachable because GStreamer auto-handles media in many desktop pipelines (thumbnailers, browsers, gst-launch consumers), but exploitation is gated on tricking a user into processing a VMnc file - an unusual codec rarely encountered outside virtualization workflows, which reduces drive-by likelihood. The UI:R requirement and lack of integrity impact mean this is more credible as a denial-of-service or memory-disclosure primitive than a full RCE chain, though OOB reads can sometimes be paired with separate write primitives. Note: the CVSS C:L rating is consistent with the description's 'information disclosure' wording, but the I:N/A:H weighting suggests the primary observed impact is crash; defenders should not over-prioritize this above pending kernel or RCE patches.
Exploit ScenarioDerived

An attacker hosts a crafted .vmnc file (or embeds a VMnc-encoded stream in a container format GStreamer auto-probes) on a website or sends it via email; when the victim opens the file in a GStreamer-backed media player such as Totem or Rhythmbox - or merely triggers a desktop thumbnailer - the VMnc decoder parses oversized cursor dimensions, overflows the payload-size calculation, and reads past the allocated buffer. The most likely outcome is an application crash (denial of service) or leakage of adjacent heap memory into decoded pixel data, which a sufficiently sophisticated attacker could combine with a separate primitive to defeat ASLR.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Out-of-bounds read in GStreamer's VMnc decoder allows remote attackers to crash the application or disclose memory contents when a victim opens a maliciously crafted VMnc video file. The flaw stems from a signed integer overflow in payload-size arithmetic that bypasses a length check when cursor dimensions are abnormally large. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

No vendor-released patch version was identified in the input at time of analysis; defenders should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52722 and the upstream GStreamer work item at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107 and apply the fixed gstreamer-plugins packages once published by their distribution (yum/dnf update gstreamer1-plugins-* on RHEL hosts). Until a patch ships, the highest-value compensating control is to disable or remove the VMnc decoder plugin specifically - on RHEL this typically lives in gstreamer1-plugins-bad-free; uninstalling that subpackage prevents auto-loading of vmncdec at the cost of also disabling other 'bad' codecs used by some media players. As a narrower mitigation, administrators can blacklist the vmncdec element via GST_PLUGIN_FEATURE_RANK=vmncdec:NONE or by removing the libgstvmnc.so file from the plugin directory, which preserves other codecs but breaks legitimate VMnc playback (rare outside VMware screen-recording workflows). User-facing guidance - do not open VMnc files from untrusted sources and disable automatic thumbnail/preview generation for unknown video files - reduces UI:R exposure but is not a substitute for patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is a widely deployed open-source multimedia framework used across Linux desktops, embedded systems, and applications such as media players, browsers, and screen-recording tools. The affected component is the VMnc decoder, which parses the VMware-developed VMnc (VMware VNC) screen-capture codec. The root cause is CWE-190 (Integer Overflow or Wraparound): when a VMnc stream declares large cursor width/height values, the multiplication used to compute the payload size overflows a signed integer, producing a small or negative result that satisfies a downstream length check while the actual data read extends past the allocated buffer, leading to out-of-bounds memory reads. Red Hat CPE data scopes the impact across Red Hat Enterprise Linux 6 through 10, since GStreamer is shipped as a core multimedia stack in those distributions.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI 7.1 HIGH

Network-delivered crafted file (AV:N) decoded with no privileges (PR:N) but requires the user to open it (UI:R); OOB read yields low confidentiality and high availability impact, no integrity effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.1 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

DescriptionCVE.org

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

Executive ViewAI

Why It Matters

GStreamer's VMnc decoder contains a high-severity out-of-bounds read vulnerability (CVSS 7.1) that allows remote attackers to crash applications or disclose sensitive memory contents through maliciously crafted video files. While no public exploit is identified at time of analysis, any system processing VMnc video streams-including multimedia platforms, collaboration tools, and content processing systems-faces immediate risks of denial of service and data leakage. The absence of vendor patches requires urgent implementation of defensive controls to reduce organizational exposure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict VMnc file processing to isolated sandboxed environments with limited memory access; (2) Implement network-based blocking of VMnc content at ingestion points; (3) Disable VMnc decoder plugin entirely if not required for business operations; (4) Apply strict network segmentation to limit lateral movement from potentially compromised GStreamer instances; (5) Establish continuous vendor advisory monitoring for patch availability; (6) Evaluate and migrate to alternative video decoders without integer overflow vulnerabilities in cursor dimension handling.

Threat Intelligence Overview

EPSS Score
0.3%
Top 80% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-52722 ADVISORY https://vuldb.com/vuln/371228 REF https://access.redhat.com/errata/RHSA-2026:36749 REF https://access.redhat.com/errata/RHSA-2026:36834 REF https://access.redhat.com/errata/RHSA-2026:37130 REF https://access.redhat.com/errata/RHSA-2026:47069 REF https://access.redhat.com/errata/RHSA-2026:47070 REF https://access.redhat.com/errata/RHSA-2026:47071 REF https://access.redhat.com/errata/RHSA-2026:47075 REF https://access.redhat.com/errata/RHSA-2026:47076 REF https://access.redhat.com/errata/RHSA-2026:47176 REF https://access.redhat.com/errata/RHSA-2026:47717 REF https://access.redhat.com/errata/RHSA-2026:47718 REF https://access.redhat.com/errata/RHSA-2026:49517 REF https://access.redhat.com/security/cve/CVE-2026-52722 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486733 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52722.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy