CVE-2026-59691

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H                                    

Vulnerability Description

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

Vulnerability Details

Published Date

July 09, 2026

Last Modified

July 09, 2026

CWE ID

CWE-787

Source

NVD

Vendor

Red Hat

Product

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

External References

https://access.redhat.com/security/cve/CVE-2026-59691
https://bugzilla.redhat.com/show_bug.cgi?id=2497343
https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/100
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5173

CVE-2026-59691

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment