CVE-2026-52720: Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Synopsis

A heap buffer overflow exists in GStreamer's librfb RFB/VNC client component within gstreamer1-plugins-bad-free. The vulnerability is reachable over the network without authentication, but requires a user to connect to a malicious VNC server, derived from the CVSS vector (AV:N/AC:L/PR:N/UI:R). Successful exploitation gives an attacker an out-of-bounds heap write that leads to arbitrary code execution or a crash. HarborGuard is tracking the advisory for patch availability, as no fix versions have been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable VNC server that the victim connects to over the network.

• AuthenticationNot required

  No credentials are needed on the attacker side; the malicious server is openly accessible.

• Victim interactionRequired

  A user must be tricked into connecting their GStreamer-based VNC client to the attacker-controlled server, making social engineering a prerequisite.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim connects; no race conditions or special memory layout knowledge are required (AC:L).

Blast Radius

• An attacker achieves an out-of-bounds heap write, providing a strong primitive for arbitrary code execution within the GStreamer process.
• All data accessible to the process, including media streams, session state, and local credentials, is exposed to reading and modification.
• The attacker can modify in-memory application state or inject malicious payloads that persist for the session lifetime.
• Triggering the overflow can crash the GStreamer process outright, disrupting any media pipeline or VNC-dependent service relying on it.