Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T00:00:00 gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CWE-787

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

This vulnerability is rated as Important severity because it is a heap out-of-bounds write reachable over the network, though exploitation requires user interaction (connecting to a malicious VNC server). The rfbsrc plugin is shipped as part of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle Operating System (RHIVOS). A user must actively connect a GStreamer pipeline to a malicious RFB/VNC server to trigger this vulnerability. Code execution has not been demonstrated but cannot be ruled out for heap overflows. This is in the same code area as CVE-2026-52720, a few lines further down. Red Hat would like to thank Clouditera Security (Clouditera), NSFOCUS (NSFOCUS), and Z.ai Security (Z.ai) for reporting this issue. There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. Do not connect GStreamer pipelines using rfbsrc to untrusted or unknown VNC servers. 2. If the rfbsrc plugin is not required, remove the librfb plugin shared object from the GStreamer plugins directory (typically /usr/lib64/gstreamer-1.0/libgstrfbsrc.so). 3. Network-level controls (firewall rules) can restrict outbound VNC connections to trusted servers only. Red Hat Enterprise Linux 10 2026-07-28T00:00:00Z RHSA-2026:47180 gstreamer1-plugins-bad-free-0:1.26.7-2.el10_2.6 Red Hat Enterprise Linux 6 Affected gstreamer-plugins-bad-free Red Hat Enterprise Linux 7 Affected gstreamer1-plugins-bad-free Red Hat Enterprise Linux 7 Affected gstreamer-plugins-bad-free Red Hat Enterprise Linux 8 Affected gstreamer1-plugins-bad-free Red Hat Enterprise Linux 9 Affected gstreamer1-plugins-bad-free https://www.cve.org/CVERecord?id=CVE-2026-59691 https://nvd.nist.gov/vuln/detail/CVE-2026-59691 https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/100 https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5173