A heap buffer overflow exists in GStreamer’s rfbsrc plugin (CWE‑787). When a client connects to a malicious RFB/VNC server advertising a 16‑bit per pixel framebuffer and sending Hextile‑encoded updates, the Hextile background fill routine writes 32‑bit pixel values into a 16‑bit buffer, producing an out‑of‑bounds heap write that can cause the client process to crash and possibly corrupt adjacent memory.

The vulnerability affects the GStreamer 1.0 libraries shipped with Red Hat Enterprise Linux 6 through 10. The flaw resides specifically in the rfbsrc plugin, which is part of the standard GStreamer plugin set on these platforms. Any installation that includes the default GStreamer distribution and uses the rfbsrc plugin — for example, systems that embed GStreamer for media handling or display connections to VNC servers — is potentially affected.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the near term. The flaw is not listed in the CISA KEV catalog, implying it has not yet been widely exploited. The attack vector is remote and requires an attacker to run a malicious VNC server that serves Hextile‑encoded updates to a client that uses rfbsrc. If the client processes such updates, the vulnerable code path executes, resulting in an out‑of‑bounds write, which may crash the application or corrupt memory. Because exploitation requires network communication with a VNC server, it can be mitigated through network filtering or by disabling the plugin entirely. Systems that do not use rfbsrc face negligible risk from this vulnerability.