This vulnerability involves a signed integer overflow in the VMnc decoder's cursor payload handling in the gstreamer1-plugins-bad-free package used by Red Hat Enterprise Linux 10. The overflow occurs when processing a crafted VMnc stream with large cursor dimensions, which causes payload-size arithmetic to overflow and bypass length checks, resulting in out-of-bounds reads. This can be triggered remotely by tricking a user into opening a malicious VMnc file. The issue is tracked as CVE-2026-52722 and is part of a security update that addresses multiple vulnerabilities in gstreamer1-plugins-bad-free.

A remote attacker can cause a denial of service (application crash) or potentially disclose information by exploiting the integer overflow in the VMnc decoder. The vulnerability allows out-of-bounds reads due to bypassed length checks, which may lead to sensitive information exposure or application instability. The CVSS 3.1 base score is 7.1, indicating a high severity impact with network attack vector, low attack complexity, no privileges required, user interaction required, and impact on confidentiality and availability.

Red Hat has released an official security update fixing this vulnerability in the gstreamer1-plugins-bad-free package. Users should apply the update to versions 10.2.4 or later of Red Hat Enterprise Linux 10 to remediate this issue. The vendor advisory (RHSA-2026:36749) provides detailed instructions on applying the update. Systems running affected versions (>=10 <10.2.4) are vulnerable until patched. No alternative mitigations are specified beyond applying the official fix.