EUVD-2026-42569
GHSA-g4ff-54hw-hj6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStand up malicious RFB/VNC server
-
DeliveryLure victim's rfbsrc client to connect
-
ExploitAdvertise 16bpp framebuffer
-
ExecutionSend Hextile background-fill update
-
PersistWrite 32-bit pixels into 16-bit heap buffer
-
ImpactOut-of-bounds heap write crashes/corrupts client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use GStreamer's rfbsrc element and to initiate an outbound connection to an attacker-controlled RFB/VNC server (UI:R in the CVSS vector - the client must connect; the attacker cannot push to an unsolicited client). The server must advertise a 16-bits-per-pixel framebuffer and send Hextile-encoded updates that exercise the background-fill path; a default/other bit-depth negotiation may not trigger the mismatch. Limiting factors: rfbsrc is a non-default, optional plugin (gst-plugins-bad) that most GStreamer deployments do not use, and the attack only works against clients that connect out to attacker-influenced VNC servers, so it is not exploitable against arbitrary internet-facing hosts. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, score 7.1) is internally consistent with the description: network reachable, no privileges, but user interaction is required because the victim's client must initiate a connection to the malicious server - the attacker cannot reach the client unsolicited. This is effectively a reverse/client-side attack, which meaningfully lowers real-world exploitability versus a server-side listener. There is no CISA KEV listing and no EPSS score provided, and no public proof-of-concept was referenced, so this reads as a real-but-not-urgent issue driven primarily by availability impact (crash) rather than confirmed reliable code execution. The 'potential memory corruption' language and CWE-787 leave open the possibility of code execution, but that is not demonstrated in the available data - treat A:H (DoS) as confirmed and RCE as speculative. |
| Exploit ScenarioDerived | An attacker stands up a malicious VNC/RFB server configured to advertise a 16bpp framebuffer and to send Hextile-encoded background-fill updates, then lures a victim into pointing their GStreamer rfbsrc-based client at that server (e.g., a media pipeline, monitoring dashboard, or automation that connects out). On connection, the crafted update triggers the 32-bit-into-16-bit heap write, crashing the client process and potentially corrupting heap memory. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Heap buffer overflow in GStreamer's rfbsrc (RFB/VNC source) plugin lets a malicious VNC server crash or corrupt the memory of any client that connects to it. When the server advertises a 16bpp framebuffer and sends Hextile-encoded updates, the background-fill path writes 32-bit pixels into a 16-bit buffer, producing an out-of-bounds heap write. No public exploit identified at time of analysis; the primary confirmed impact is denial of service, with potential for further memory corruption. This is a client-side flaw requiring the victim to connect to attacker-controlled infrastructure.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the GStreamer update once your distribution ships it, tracking the upstream fix at https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/100 and, for Red Hat systems, the errata linked from https://access.redhat.com/security/cve/CVE-2026-59691 and https://bugzilla.redhat.com/show_bug.cgi?id=2497343. Until a patched build is installed, the concrete compensating control is to avoid using the rfbsrc element to connect to untrusted or attacker-controllable VNC/RFB servers; if you operate GStreamer pipelines that use rfbsrc, restrict them to known-trusted VNC endpoints, or disable/remove the rfbsrc plugin from gst-plugins-bad if it is not needed (side effect: any pipeline relying on VNC ingestion will stop functioning). Where feasible, run media pipelines under a sandbox or with hardened heap allocators to blunt the impact of the out-of-bounds write.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is the dominant open-source multimedia framework on Linux, used for pipeline-based media capture, decoding and streaming. The affected component is the rfbsrc element (part of gst-plugins-bad), which acts as a VNC/RFB client source, pulling remote framebuffer data into a GStreamer pipeline. The RFB protocol's Hextile encoding compresses rectangles by tiling them and applying background/foreground fills. The root cause is CWE-787 (Out-of-bounds Write): a pixel-size type mismatch where the Hextile background-fill routine emits 32-bit pixel values into a heap buffer that was allocated assuming the server-advertised 16-bit-per-pixel format, so each fill overruns the allocation.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Victim's client must connect out to a malicious server (UI:R, AV:N, PR:N); confirmed impact is process crash (A:H) with limited/uncertain integrity impact (I:L) and no confidentiality loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
Executive ViewAI
A heap buffer overflow in GStreamer's VNC/RFB plugin (CVE-2026-59691, CVSS 7.1) enables malicious VNC servers to crash media streaming services or corrupt application memory when clients connect. Organizations using GStreamer for video playback, remote access applications, or media infrastructure face service disruptions and data integrity risks from untrusted VNC connections.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable rfbsrc plugin if VNC source connectivity is not required; (2) Restrict outbound connections to a whitelist of trusted, internal VNC servers at the network and firewall layers; (3) Deploy memory protection mechanisms (ASLR, DEP/NX) on systems running GStreamer to increase exploitation difficulty; (4) Implement application-level monitoring to detect and alert on unexpected crashes or memory corruption symptoms; (5) Isolate vulnerable systems within network segments to limit lateral movement if memory corruption is successfully exploited.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB