This vulnerability involves a signed integer overflow in GStreamer's VMnc decoder on Red Hat Enterprise Linux 10. The overflow occurs when processing crafted VMnc streams with large cursor dimensions, which leads to bypassing length checks and results in out-of-bounds memory reads. The flaw can be exploited remotely by convincing a user to open a malicious VMnc file, causing denial of service or limited information disclosure. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. No official patch or remediation level is stated in the vendor advisory as of the published date. The vendor advisory link is provided for monitoring updates.

Successful exploitation can lead to application crashes (denial of service) or information disclosure due to out-of-bounds reads. The vulnerability requires user interaction (opening a crafted file) and does not require privileges. Confidentiality impact is limited, integrity is unaffected, but availability impact is high due to potential crashes.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52722 for current remediation guidance. Until a patch is available, users should avoid opening untrusted VMnc files to mitigate risk.