Bug 2486731 (CVE-2026-52720)

Summary: CVE-2026-52720 gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-09 07:33:54 UTC 
GStreamer librfb (RFB/VNC client) heap buffer overflow vulnerability. In rfbdecoder.c (gst-plugins-bad), the rectangle bounds check incorrectly validates area rather than individual dimensions: if (((w * h) + (x * y)) > (decoder->width * decoder->height)). A malicious VNC server can send a FramebufferUpdate with crafted x/y/w/h values (e.g., x=0, y=0, w=2000, h=1 on a 1920-wide framebuffer) that pass this check but extend beyond the framebuffer. The raw encoding function then performs memcpy(frame, p, raw_line_size) where raw_line_size = w * bytespp is larger than the framebuffer line, writing past the end of each line into adjacent heap memory. This results in a controlled out-of-bounds heap write. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB write. Triggers when connecting to a malicious/broken VNC/RFB server." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).