A heap buffer overflow exists in GStreamer's RFB/VNC client (librfb) where the rectangle bounds check validates the area instead of individual width and height values. This flaw allows a malicious VNC server to transmit a rectangle that exceeds the framebuffer bounds, causing an out-of-bounds heap write. The overflow can lead to arbitrary code execution or a process crash, compromising the integrity of the application and potentially the system if privileges are elevated.

The issue affects Red Hat Enterprise Linux distributions from version 6 through version 10, as Red Hat security updates target these platforms. No specific patch release or version ranges are listed in the CNA data, so users should consider all affected releases as vulnerable until a fix is made available.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an attacker controls a VNC server and persuades a user to connect to it. No local privilege escalation or user interaction beyond connecting is required, meaning the flaw can be triggered simply by a user initiating a VNC session with a crafted server. As no mitigation exists yet other than patching, the risk remains significant for systems that allow arbitrary VNC connections.