CVE-2026-52722

Summary

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

Affected Software

Weaknesses

• CWE-190: Integer Overflow or Wraparound

Workarounds

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling

Additional References

• https://access.redhat.com/security/cve/CVE-2026-52722
• https://bugzilla.redhat.com/show_bug.cgi?id=2486733
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52722.json

References

• https://access.redhat.com/security/cve/CVE-2026-52722
• https://bugzilla.redhat.com/show_bug.cgi?id=2486733
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5107

• ←Previous
• Next→