GStreamer VMnc decoder signed integer overflow vulnerability. In vmncdec.c (gst-plugins-bad), at line 408, the cursor payload size computation datalen += rect->width * rect->height * dec->format.bytes_per_pixel * 2 uses signed 32-bit arithmetic. A crafted VMnc stream with large cursor dimensions (e.g., 65535 x 65535) overflows the signed multiplication to a negative value, causing datalen to become small or negative. The check if (len < datalen) then passes, g_malloc(size) allocates a tiny buffer, but the rendering loop in render_colour_cursor() uses the original large width/height values (dec->cursor.width = 65535) to iterate, reading far beyond the tiny allocated buffer into adjacent heap memory. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, integer overflow that leads to OOB reads. Can lead to crashes or possibly information disclosure, and can be triggered from specially crafted files." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).