REDHAT-BUG-2486731: Buffer Overflow
GStreamer librfb (RFB/VNC client) heap buffer overflow vulnerability. In rfbdecoder.c (gst-plugins-bad), the rectangle bounds check incorrectly validates area rather than individual dimensions: if (((w h) + (x y)) > (decoder->width decoder->height)). A malicious VNC server can send a FramebufferUpdate with crafted x/y/w/h values (e.g., x=0, y=0, w=2000, h=1 on a 1920-wide framebuffer) that pass this check but extend beyond the framebuffer. The raw encoding function then performs memcpy(frame, p, rawlinesize) where rawlinesize = w bytespp is larger than the framebuffer line, writing past the end of each line into adjacent heap memory. This results in a controlled out-of-bounds heap write. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB write. Triggers when connecting to a malicious/broken VNC/RFB server." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5105 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer librfb (gst-plugins-bad) rfbdecoder.cto a version that resolves this vulnerability.Fixed in 1.28.4Patch PSIRTSUPT-17026 - Compensating control
Avoid connecting the GStreamer librfb (RFB/VNC client) to untrusted or potentially malicious VNC/RFB servers; only connect to trusted endpoints to prevent triggering the crafted FramebufferUpdate OOB write.
Event History
Frequently Asked Questions
What is REDHAT-BUG-2486731?
REDHAT-BUG-2486731 is a high-severity heap buffer overflow vulnerability in the GStreamer librfb (RFB/VNC client) related to incorrect rectangle bounds checking.
What is the severity of REDHAT-BUG-2486731?
The severity of REDHAT-BUG-2486731 is classified as high, with a risk score of 7.
How do I fix REDHAT-BUG-2486731?
To fix REDHAT-BUG-2486731, you should update to the latest version of GStreamer gst-plugins-bad where this vulnerability has been addressed.
What causes the vulnerability in REDHAT-BUG-2486731?
The vulnerability in REDHAT-BUG-2486731 is caused by a heap buffer overflow due to incorrect validation of area rather than individual dimensions in the rectangle bounds check.
What can a malicious VNC server do in relation to REDHAT-BUG-2486731?
A malicious VNC server can exploit REDHAT-BUG-2486731 to send crafted data causing a buffer overflow, potentially leading to arbitrary code execution.