CVE-2026-52720: Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that could lead to code execution or a crash.
Other sources
GStreamer librfb (RFB/VNC client) heap buffer overflow vulnerability. In rfbdecoder.c (gst-plugins-bad), the rectangle bounds check incorrectly validates area rather than individual dimensions: if (((w h) + (x y)) > (decoder->width decoder->height)). A malicious VNC server can send a FramebufferUpdate with crafted x/y/w/h values (e.g., x=0, y=0, w=2000, h=1 on a 1920-wide framebuffer) that pass this check but extend beyond the framebuffer. The raw encoding function then performs memcpy(frame, p, rawlinesize) where rawlinesize = w bytespp is larger than the framebuffer line, writing past the end of each line into adjacent heap memory. This results in a controlled out-of-bounds heap write. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB write. Triggers when connecting to a malicious/broken VNC/RFB server." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5105 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer librfb (RFB/VNC client)to a version that resolves this vulnerability.Fixed in 1.28.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52720?
CVE-2026-52720 has a high severity rating of 8.8.
What type of vulnerability is CVE-2026-52720?
CVE-2026-52720 is a heap buffer overflow vulnerability located in GStreamer's librfb.
How can I mitigate CVE-2026-52720?
To mitigate CVE-2026-52720, ensure GStreamer gstreamer1-plugins-bad-free is updated to the latest version.
Who is affected by CVE-2026-52720?
Users of GStreamer gstreamer1-plugins-bad-free with librfb are at risk of exploitation due to CVE-2026-52720.
What could an attacker do using CVE-2026-52720?
An attacker could exploit CVE-2026-52720 to execute arbitrary code on a victim's machine by sending crafted VNC server data.