GStreamer librfb (RFB/VNC client) heap buffer overflow vulnerability. In rfbdecoder.c (gst-plugins-bad), the rectangle bounds check incorrectly validates area rather than individual dimensions: if (((w h) + (x y)) > (decoder->width decoder->height)). A malicious VNC server can send a FramebufferUpdate with crafted x/y/w/h values (e.g., x=0, y=0, w=2000, h=1 on a 1920-wide framebuffer) that pass this check but extend beyond the framebuffer. The raw encoding function then performs memcpy(frame, p, rawlinesize) where rawlinesize = w bytespp is larger than the framebuffer line, writing past the end of each line into adjacent heap memory. This results in a controlled out-of-bounds heap write. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, OOB write. Triggers when connecting to a malicious/broken VNC/RFB server." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5105 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).