CVE-2026-52722: Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

Synopsis

A signed integer overflow vulnerability exists in GStreamer's VMnc decoder, affecting Red Hat Enterprise Linux across all major versions (6 through 10). The flaw is reachable over the network but requires a user to open a crafted VMnc media file; no authentication is needed from the attacker's side. Successful exploitation causes the application to crash or leaks memory contents to the attacker. No upstream fix has been published yet; HarborGuard tracks this advisory and will flag affected images the moment a patch becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a malicious VMnc file over the network, so the target service or user must be reachable from an external or remote origin.

• AuthenticationNot required

  No account or credential is required; the attacker only needs to get the crafted file in front of a user.

• Victim interactionRequired

  A user must be socially engineered into opening the specially crafted VMnc file for the overflow to trigger.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable once the file is opened; no race conditions or special memory layout is required.

Blast Radius

• The affected GStreamer process crashes, terminating any media pipeline or application relying on VMnc playback.
• Out-of-bounds reads expose regions of process memory, which may contain session tokens, decoded frame buffers, or other in-process data.