Threats Tagged 'cve-2026-52720'

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-bad-free package used in Red Hat Enterprise Linux 10 and related products. These include denial of service, out-of-bounds read, heap buffer overflow, and signed integer overflow issues affecting various decoders and components within GStreamer. Red Hat has released an important security update addressing these issues.

Multiple security vulnerabilities have been identified in the gstreamer1-plugins-bad-free package used in Red Hat Enterprise Linux 9 and related distributions. These include denial of service, out-of-bounds read, heap buffer overflow, and signed integer overflow issues affecting various decoders and components within GStreamer. The vulnerabilities have been assigned CVEs CVE-2026-52718, CVE-2026-52719, CVE-2026-52720, and CVE-2026-52722. Red Hat has issued a security advisory with updates to address these issues.

A heap buffer overflow vulnerability (CVE-2026-52720) exists in GStreamer's librfb component used for RFB/VNC client functionality. The vulnerability arises because the rectangle bounds check validates the area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. This can lead to an out-of-bounds heap write, potentially causing a crash or remote code execution if a user connects to a malicious VNC server. Red Hat has issued a security update for gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8 to address this issue.