Executive brief
GStreamer is a widely used multimedia framework for handling audio and video playback on Linux and other platforms. A security flaw in its VMnc video decoder allows a specially crafted video file to cause the application to crash or potentially leak sensitive information from memory. This could be exploited if a user is tricked into opening a malicious video file or visiting a website that automatically processes such content.
Technical details
A signed integer overflow vulnerability exists in the VMnc decoder (vmncdec.c) within GStreamer's 'bad' plugins. The flaw occurs during the computation of cursor payload sizes where signed 32-bit arithmetic is used to calculate 'datalen' based on cursor dimensions. By providing a crafted VMnc stream with extremely large dimensions (e.g., 65535x65535), an attacker can cause the multiplication to overflow, resulting in a small or negative value that bypasses length checks. This leads to a small heap allocation followed by an out-of-bounds read when the rendering loop iterates using the original large dimensions. The vulnerability is exploitable via network delivery (e.g., a malicious file) requiring minimal user interaction. A fix is planned for GStreamer version 1.28.4.
Affected products
- GStreamer gstreamer1-plugins-bad-free versions prior to 1.28.4
Timeline
- 2026-06-02: other: Vulnerability confirmed by upstream maintainer
- 2026-06-09: other: Initial bug report filed in Red Hat Bugzilla
- 2026-06-15: disclosed: Public disclosure of CVE-2026-52722