Threats Tagged 'cve-2026-59692'

A heap buffer overflow vulnerability exists in the GStreamer rfbsrc plugin when connecting to a malicious RFB/VNC server that uses a 16bpp framebuffer with Hextile encoding. This causes an out-of-bounds write in heap memory, potentially leading to denial of service or memory corruption. Exploitation requires user interaction by connecting to a malicious server. The vulnerability affects the gstreamer1-plugins-bad-free package in Red Hat Enterprise Linux versions 8, 9, and 10. No complete mitigation is available, but risk can be reduced by avoiding untrusted VNC servers and removing the vulnerable plugin if unused.

Two security vulnerabilities were addressed in the gstreamer1-plugins-bad-free package for Red Hat Enterprise Linux 10. These include a heap out-of-bounds write in the rfbsrc/librfb Hextile with 16bpp framebuffer (CVE-2026-59691) and a stack buffer overflow in the DTLS certificate Subject DN verification callback (CVE-2026-59692). Red Hat has released an important security update to fix these issues.

Multiple security vulnerabilities have been identified and fixed in the gstreamer-plugins-bad component. These include out-of-bounds reads and writes, heap and stack buffer overflows, and improper validation issues affecting various parsers such as H.264, H.265, H.266, WebRTC, IPv4/TCP headers, and DTLS handshake processing. The issues could lead to memory corruption or crashes. No CVSS score is provided, but the severity is assessed as high due to the nature of the vulnerabilities.

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.