A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

GStreamer VMnc decoder signed integer overflow vulnerability. In vmncdec.c (gst-plugins-bad), at line 408, the cursor payload size computation datalen += rect->width rect->height dec->format.bytesperpixel 2 uses signed 32-bit arithmetic. A crafted VMnc stream with large cursor dimensions (e.g., 65535 x 65535) overflows the signed multiplication to a negative value, causing datalen to become small or negative. The check if (len < datalen) then passes, gmalloc(size) allocates a tiny buffer, but the rendering loop in rendercolourcursor() uses the original large width/height values (dec->cursor.width = 65535) to iterate, reading far beyond the tiny allocated buffer into adjacent heap memory. Upstream confirmed by maintainer Sebastian Dröge (2026-06-02): "Confirmed, integer overflow that leads to OOB reads. Can lead to crashes or possibly information disclosure, and can be triggered from specially crafted files." Fix planned for GStreamer 1.28.4. Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5107 (confidential). Reported via PSIRTSUPT-17026 by JUNYI LIU / Moss (moss80199).