Is CVE-2026-59691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59691 being exploited in the wild.

How severe is CVE-2026-59691?

High severity, with a CVSS score of 7.1, published 9 July 2026.

Which products and versions are affected?

Gstreamer Gst-Plugins-Bad Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat GStreamer gst-plugins-bad-free Red Hat Enterprise Linux 6, 7, 8, 9, 10.

Is there a fix for CVE-2026-59691?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59691?

Check whether you run Gstreamer Gst-Plugins-Bad or Red Hat GStreamer gst-plugins-bad-free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59691: GStreamer rfbsrc heap buffer overflow in Hextile decoding

CVE-2026-59691 · Severity: high · CVSS 7.1 · Published 2026-07-09

A security vulnerability exists in GStreamer, a widely used multimedia framework, specifically within its VNC/RFB connection plugin. If a user connects to a malicious VNC server using this software, the server can send specially crafted video updates that cause the application to crash or corrupt its memory. This could lead to a denial of service or potentially allow an attacker to compromise the integrity of the system running the GStreamer application.

Technologies: Gstreamer Gst-Plugins-Bad. Vendors: Gstreamer, Red Hat.

Quick answers

Is CVE-2026-59691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59691 being exploited in the wild.
How severe is CVE-2026-59691?: High severity, with a CVSS score of 7.1, published 9 July 2026.
Which products and versions are affected?: Gstreamer Gst-Plugins-Bad Red Hat Enterprise Linux 6, 7, 8, 9, 10; Red Hat GStreamer gst-plugins-bad-free Red Hat Enterprise Linux 6, 7, 8, 9, 10.
Is there a fix for CVE-2026-59691?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59691?: Check whether you run Gstreamer Gst-Plugins-Bad or Red Hat GStreamer gst-plugins-bad-free at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow vulnerability exists in GStreamer's rfbsrc plugin (specifically within the librfb component) due to a type mismatch in the rfb_decoder_fill_rectangle() function. When a client connects to a malicious RFB/VNC server advertising a 16bpp (bits per pixel) framebuffer, the Hextile background fill path incorrectly casts a 16-bit destination buffer to a 32-bit pointer (guint32*). This causes the decoder to write 32-bit pixel values into memory allocated for 16-bit pixels, leading to an out-of-bounds heap write. An attacker can exploit this by hosting a malicious VNC server and enticing a user to connect via GStreamer, resulting in a process crash or potential memory corruption. A fix is planned for GStreamer version 1.28.5.

Affected products

Red Hat GStreamer gst-plugins-bad-free Red Hat Enterprise Linux 6, 7, 8, 9, 10
GStreamer gst-plugins-bad 1.28.3

Timeline

2026-07-06: disclosed: Reported by OSIDB Bzimport
2026-07-09: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.