# CVE-2026-52720: GStreamer librfb heap buffer overflow in VNC rectangle decoding

Source: https://junglewise.ai/threats/cve-2026-52720-gstreamer-librfb-heap-buffer-overflow-in-vnc-rectangle-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-52720 · Severity: high · CVSS 8.8 · Published 2026-06-15

A security vulnerability exists in GStreamer's VNC client component, which is used by various applications to view remote desktops. If a user is tricked into connecting to a malicious VNC server, the server can send specially crafted image data that overflows the application's memory. This could allow an attacker to crash the application or potentially take control of the user's computer.

Vendors: [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer).

## Quick answers

**Is CVE-2026-52720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52720 being exploited in the wild.

**How severe is CVE-2026-52720?** High severity, with a CVSS score of 8.8, published 15 June 2026.

**Which products and versions are affected?** Gstreamer Librfb Versions prior to 1.28.4.

**Is there a fix for CVE-2026-52720?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52720 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52720?** Check whether you run Gstreamer Librfb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the librfb component of GStreamer (specifically within rfbdecoder.c in gst-plugins-bad). The vulnerability stems from an incorrect bounds check that validates the total area of a rectangle (w * h) rather than individual dimensions against the framebuffer's width and height. An attacker-controlled VNC server can send a FramebufferUpdate with dimensions that pass the area check but exceed the framebuffer's width. This causes the raw encoding function to perform a memcpy that writes past the end of the allocated buffer. Exploitation requires a user to initiate a connection to a malicious server (User Interaction). A fix is planned for GStreamer version 1.28.4.

## Affected products

- GStreamer GStreamer librfb (gst-plugins-bad) Versions prior to 1.28.4

## Timeline

- 2026-06-02: other: Upstream maintainer confirmed the vulnerability
- 2026-06-09: other: Bug reported to Red Hat Bugzilla
- 2026-06-15: disclosed: Vulnerability details published via NVD and Red Hat

## References

- [https://access.redhat.com/security/cve/CVE-2026-52720](https://access.redhat.com/security/cve/CVE-2026-52720)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2486731](https://bugzilla.redhat.com/show_bug.cgi?id=2486731)
- [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5105)