Bug 2486733 (CVE-2026-52722)

Summary: CVE-2026-52722 gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-09 07:37:00 UTC 
GStreamer VMnc decoder signed integer overflow vulnerability. In vmncdec.c (gst-plugins-bad), at line 408, the cursor payload size computation datalen += rect->width * rect->height * dec->format.bytes_per_pixel * 2 uses signed 32-bit arithmetic. A crafted VMnc stream with large cursor dimensions (e.g., 65535 x 65535) overflows the signed multiplication to a negative value, causing datalen to become small or negative. The check if (len < datalen) then passes, g_malloc(size) allocates a tiny buffer, but the rendering loop in render_colour_cursor() uses the original large width/height values (dec->cursor.width = 65535) to iterate, reading far beyond the tiny allocated buffer into adjacent heap memory. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, integer overflow that leads to OOB reads. Can lead to crashes or possibly information disclosure, and can be triggered from specially crafted files." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).