Heap-based buffer overflow in gst-plugins-bad and gstreamer - CVE-2026-59691

Vulnerability identifier: #VU141118

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59691

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in rfbsrc element RFB decoder when decoding crafted framebuffer updates from a VNC server. A remote attacker can operate a crafted VNC server and send framebuffer updates with specific pixel formats and encoding types to execute arbitrary code.

This may also cause a crash, denial of service, or data corruption in the client application.

gst-plugins-bad
gstreamer
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
gstreamer1-plugins-bad-free (Red Hat package)

Install security update from vendor's website.

gst-plugins-bad - update to 1.28.5
gstreamer - update to 1.28.5
gstreamer1-plugins-bad-free (Red Hat package) - addressed in versions 1.16.1-9.el8_10.1, 1.26.7-2.el10_2.6

• https://gstreamer.freedesktop.org/security/sa-2026-0063.html
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12054.patch

• Multiple vulnerabilities in GStreamer
• Red Hat Enterprise Linux 10 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 8 update for gstreamer1-plugins-bad-free