REDHAT-BUG-2497343: Buffer Overflow
A heap buffer overflow was found in GStreamer's rfbsrc plugin (gst-plugins-bad, librfb component). In rfbdecoderfillrectangle(), when a malicious RFB/VNC server advertises a 16bpp RGB565 framebuffer and sends a Hextile-encoded update, the background fill path computes the destination offset using decoder->bytespp (2 bytes) but casts the destination to guint32 and writes one 32-bit value per pixel. For bytespp == 2, the framebuffer is allocated as 2 bytes per pixel, but the fill loop writes and advances by 4 bytes per pixel, causing a heap out-of-bounds write.
File: subprojects/gst-plugins-bad/gst/librfb/rfbdecoder.c Function: rfbdecoderfillrectangle()
A remote attacker controlling an RFB/VNC server can trigger this by having a client connect using rfbsrc. The demonstrated impact is heap-buffer-overflow and process abort. Since this is a heap out-of-bounds write on remote input, integrity impact is possible though code execution has not been demonstrated.
Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/100 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5173 (confidential) Advisory: GST-SA-2026-0063
Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19089
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (librfb / rfbsrc plugin)to a version that resolves this vulnerability.Fixed in 1.28.5Patch GST-SA-2026-0063 - Compensating control
Mitigate the remote trigger by preventing untrusted RFB/VNC servers from being used by clients that load GStreamer gst-plugins-bad rfbsrc (librfb). Restrict/allowlist which RFB/VNC endpoints can be reached.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2497343?
The severity of REDHAT-BUG-2497343 is high, rated at 7.
What type of vulnerability is REDHAT-BUG-2497343?
REDHAT-BUG-2497343 is categorized as a heap buffer overflow vulnerability.
How do I fix REDHAT-BUG-2497343?
To fix REDHAT-BUG-2497343, update the GStreamer gst-plugins-bad package to the latest patched version.
What consequences can arise from REDHAT-BUG-2497343?
Exploiting REDHAT-BUG-2497343 could allow an attacker to execute arbitrary code within the context of the affected application.
Which software is affected by REDHAT-BUG-2497343?
REDHAT-BUG-2497343 affects the GStreamer gst-plugins-bad package, specifically the librfb component.