This vulnerability involves a heap buffer overflow in GStreamer's librfb (RFB/VNC client) due to incorrect validation of rectangle bounds. Instead of validating individual dimensions, the check validates the area, allowing a malicious VNC server to send a rectangle that exceeds the framebuffer boundary. When a user connects to such a server, this can trigger an out-of-bounds heap write, which may lead to code execution or a crash. The issue affects Red Hat Enterprise Linux versions 9 and 10 prior to 9.8.1 and 10.2.4 respectively. Red Hat has issued security advisories and patches for the gstreamer1-plugins-bad-free package to fix this vulnerability.

A remote attacker controlling a malicious VNC server can exploit this vulnerability by tricking a user into connecting, resulting in an out-of-bounds heap write. This can cause a denial of service (application crash) or potentially allow remote code execution with the privileges of the user running the VNC client. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates for the gstreamer1-plugins-bad-free package that address this vulnerability. Users should apply the updates to versions 10.2.4 or later for Red Hat Enterprise Linux 10 and 9.8.1 or later for Red Hat Enterprise Linux 9. Detailed update instructions are available in Red Hat's advisory and knowledge base article. No additional mitigation is required once the update is applied.