This vulnerability in GStreamer's librfb (RFB/VNC client) occurs due to improper validation of rectangle bounds, where the check incorrectly validates the area instead of each dimension. A remote attacker controlling a malicious VNC server can exploit this by sending a crafted rectangle that extends beyond the framebuffer, triggering a heap buffer overflow. This out-of-bounds write may lead to arbitrary code execution or application crash. The issue affects Red Hat Enterprise Linux versions 9 and 10 prior to the fixed releases. Red Hat has issued security advisories RHSA-2026:36749 and RHSA-2026:36834 providing patches in updated gstreamer1-plugins-bad-free packages.

Successful exploitation allows a remote attacker to cause a heap buffer overflow in the VNC client, potentially leading to remote code execution or denial of service (application crash). The vulnerability requires user interaction (connecting to a malicious VNC server). The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Red Hat has released official security updates that fix this vulnerability in the gstreamer1-plugins-bad-free package for Red Hat Enterprise Linux 9 and 10. Users should apply the updates as described in Red Hat advisories RHSA-2026:36749 and RHSA-2026:36834. The advisories provide detailed instructions and updated package versions. Applying these patches fully mitigates the vulnerability. No additional mitigations are specified or required beyond applying the official updates.