CVE-2026-52722: Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Other sources
GStreamer VMnc decoder signed integer overflow vulnerability. In vmncdec.c (gst-plugins-bad), at line 408, the cursor payload size computation datalen += rect->width rect->height dec->format.bytesperpixel 2 uses signed 32-bit arithmetic. A crafted VMnc stream with large cursor dimensions (e.g., 65535 x 65535) overflows the signed multiplication to a negative value, causing datalen to become small or negative. The check if (len < datalen) then passes, gmalloc(size) allocates a tiny buffer, but the rendering loop in rendercolourcursor() uses the original large width/height values (dec->cursor.width = 65535) to iterate, reading far beyond the tiny allocated buffer into adjacent heap memory. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, integer overflow that leads to OOB reads. Can lead to crashes or possibly information disclosure, and can be triggered from specially crafted files." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5107 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer 1.28.4to a version that resolves this vulnerability.Fixed in 1.28.4 - Compensating control
Mitigate the vulnerability by preventing users from opening specially crafted VMnc files (e.g., block or do not open untrusted .vmnc inputs / restrict VMnc file handling) until GStreamer 1.28.4 is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52722?
CVE-2026-52722 has a severity rating of 7.1 out of 10, indicating a high risk.
What is the nature of the vulnerability described in CVE-2026-52722?
CVE-2026-52722 is a signed integer overflow vulnerability in the VMnc decoder of GStreamer.
How can I fix CVE-2026-52722?
To mitigate CVE-2026-52722, users should update to the latest version of GStreamer that addresses this vulnerability.
What types of attacks could exploit CVE-2026-52722?
A remote attacker could exploit CVE-2026-52722 by tricking a user into opening a specially crafted VMnc stream.
What software is affected by CVE-2026-52722?
The vulnerable software impacted by CVE-2026-52722 is the GStreamer package, specifically gstreamer1-plugins-bad-free.