CVE-2026-59691 is a heap buffer overflow vulnerability in the GStreamer rfbsrc plugin's handling of Hextile-encoded updates from RFB/VNC servers advertising a 16bpp framebuffer. The vulnerability arises because the plugin writes 32-bit pixel values into a buffer allocated for 16-bit pixels, causing an out-of-bounds heap write. This can lead to process crashes and potential memory corruption. Exploitation requires a user to connect a GStreamer pipeline to a malicious VNC server. While code execution has not been demonstrated, it cannot be ruled out. This vulnerability is rated as Important by Red Hat and affects gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat In-Vehicle Operating System. No official patch or complete mitigation is available, but risk reduction measures include avoiding untrusted VNC servers, removing the rfbsrc plugin if not needed, and restricting outbound VNC connections via firewall rules.

The vulnerability can cause denial of service through process crashes and potential memory corruption when a user connects to a malicious RFB/VNC server using the vulnerable plugin. While remote code execution has not been confirmed, the heap overflow nature means it cannot be excluded. The attack requires user interaction (connecting to a malicious server). The impact is rated as high for availability and low for integrity, with no confidentiality impact.

There is no complete mitigation or official patch available for this vulnerability. To reduce risk: (1) Do not connect GStreamer pipelines using the rfbsrc plugin to untrusted or unknown VNC servers. (2) If the rfbsrc plugin is not required, remove the librfb plugin shared object (libgstrfbsrc.so) from the GStreamer plugins directory. (3) Use network-level controls such as firewall rules to restrict outbound VNC connections to trusted servers only.