Executive brief
A security vulnerability exists in GStreamer's VNC client component, which is used by various applications to view remote desktops. If a user is tricked into connecting to a malicious VNC server, the server can send specially crafted image data that overflows the application's memory. This could allow an attacker to crash the application or potentially take control of the user's computer.
Technical details
A heap-based buffer overflow (CWE-122) exists in the librfb component of GStreamer (specifically within rfbdecoder.c in gst-plugins-bad). The vulnerability stems from an incorrect bounds check that validates the total area of a rectangle (w * h) rather than individual dimensions against the framebuffer's width and height. An attacker-controlled VNC server can send a FramebufferUpdate with dimensions that pass the area check but exceed the framebuffer's width. This causes the raw encoding function to perform a memcpy that writes past the end of the allocated buffer. Exploitation requires a user to initiate a connection to a malicious server (User Interaction). A fix is planned for GStreamer version 1.28.4.
Affected products
- GStreamer GStreamer librfb (gst-plugins-bad) Versions prior to 1.28.4
Timeline
- 2026-06-02: other: Upstream maintainer confirmed the vulnerability
- 2026-06-09: other: Bug reported to Red Hat Bugzilla
- 2026-06-15: disclosed: Vulnerability details published via NVD and Red Hat