The vulnerability CVE-2026-52722 involves a signed integer overflow in the VMnc decoder component of the GStreamer framework's gstreamer1-plugins-bad-free package. Specifically, when processing a specially crafted VMnc stream with large cursor dimensions, the arithmetic for payload size overflows, which allows bypassing of length validation checks and results in out-of-bounds memory reads. This flaw can be triggered remotely by convincing a user to open a malicious VMnc file, potentially causing a denial of service or information disclosure. Red Hat has issued security advisories and updates for Red Hat Enterprise Linux 10 to fix this issue by updating the gstreamer1-plugins-bad-free package to a patched version. The vulnerability has a CVSS v3.1 score of 7.1 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and availability.

A remote attacker can exploit this vulnerability by delivering a specially crafted VMnc file to a user, leading to a signed integer overflow in the VMnc decoder. This can cause out-of-bounds reads, potentially resulting in application crashes (denial of service) or information disclosure. The impact is rated as high severity due to the possibility of denial of service and limited confidentiality impact. There are no known exploits in the wild at this time.

Red Hat has released an official security update that fixes this vulnerability by patching the gstreamer1-plugins-bad-free package. Users of Red Hat Enterprise Linux 10 should apply the update to version 10.2.4 or later to remediate this issue. Refer to Red Hat's advisory RHSA-2026:36749 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are required beyond applying the official patch.