CVE-2026-59691: Gstreamer: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
Other sources
A heap buffer overflow was found in GStreamer's rfbsrc plugin (gst-plugins-bad, librfb component). In rfbdecoderfillrectangle(), when a malicious RFB/VNC server advertises a 16bpp RGB565 framebuffer and sends a Hextile-encoded update, the background fill path computes the destination offset using decoder->bytespp (2 bytes) but casts the destination to guint32 and writes one 32-bit value per pixel. For bytespp == 2, the framebuffer is allocated as 2 bytes per pixel, but the fill loop writes and advances by 4 bytes per pixel, causing a heap out-of-bounds write.
File: subprojects/gst-plugins-bad/gst/librfb/rfbdecoder.c Function: rfbdecoderfillrectangle()
A remote attacker controlling an RFB/VNC server can trigger this by having a client connect using rfbsrc. The demonstrated impact is heap-buffer-overflow and process abort. Since this is a heap out-of-bounds write on remote input, integrity impact is possible though code execution has not been demonstrated.
Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/100 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5173 (confidential) Advisory: GST-SA-2026-0063
Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19089
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59691?
The severity of CVE-2026-59691 is rated as high with a score of 7.1.
How do I fix CVE-2026-59691?
To fix CVE-2026-59691, update GStreamer to the latest version that addresses the heap buffer overflow vulnerability.
What type of vulnerability is identified in CVE-2026-59691?
CVE-2026-59691 is classified as a heap buffer overflow vulnerability in the GStreamer rfbsrc plugin.
What can be exploited in CVE-2026-59691?
CVE-2026-59691 can be exploited when a client connects to a malicious RFB/VNC server that sends improperly encoded updates.
What impact does CVE-2026-59691 have on users?
CVE-2026-59691 may allow an attacker to perform an out-of-bounds write, potentially leading to application crashes or arbitrary code execution.