Multiple heap-based vulnerabilities were identified in the GStreamer gst-plugins-bad package affecting the adpcmdec element, librfb (RFB/VNC client), and VMnc decoder. These include a heap out-of-bounds write during IMA/DVI ADPCM audio decoding, a heap buffer overflow from improper rectangle bounds checking in the VNC client, and a signed integer overflow leading to out-of-bounds reads in the VMnc decoder. Exploitation could result in application crashes, denial of service, memory corruption, information disclosure, or potentially arbitrary code execution when processing crafted media files or connecting to malicious VNC servers. A security update fixing these issues is available in version 1.16.2-20.oe2403sp1.