A signed integer overflow was discovered in GStreamer's VMnc decoder cursor payload handling. The overflow allows a crafted VMnc stream with large cursor dimensions to bypass a length check by corrupting signed integer payload‑size arithmetic, resulting in out‑of‑bounds reads. An attacker who lures a user into opening a malicious VMnc file could trigger a crash or cause sensitive data to be disclosed.

The vulnerability affects the Red Hat Enterprise Linux distribution across versions 6, 7, 8, 9, and 10, through the bundled GStreamer 1.0 plugins, specifically the bad‑free set that includes the VMnc decoder.

The flaw carries a CVSS score of 7.1 and an EPSS score of less than 1 %, indicating a moderate severity but low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The exploit requires user interaction – the victim must be tricked into opening a malicious VMnc file – and does not provide remote code execution. Nonetheless, because the vulnerability can lead to a crash or information disclosure, it is advisable to remediate promptly.