The vulnerability in GStreamer's rfbsrc plugin is a heap buffer overflow triggered by a type mismatch during processing of Hextile-encoded framebuffer updates from a malicious RFB/VNC server. Specifically, when the server advertises a 16 bits-per-pixel framebuffer but sends Hextile-encoded updates, the plugin writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This out-of-bounds write can cause process crashes and memory corruption, potentially leading to denial of service.

Exploitation of this vulnerability can cause the affected process to crash, resulting in denial of service. Additionally, the heap buffer overflow may lead to memory corruption, which could have further undefined impacts depending on the context. There is no confirmed information about remote code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting to untrusted or malicious RFB/VNC servers using the vulnerable GStreamer rfbsrc plugin versions.