CVE-2026-59691

Name of the Vulnerable Software and Affected Versions GStreamer (affected versions not specified)

Description A heap buffer overflow exists in the rfbsrc plugin. The issue occurs when a client connects to a malicious RFB/VNC server that advertises a 16bpp (bits per pixel) framebuffer and sends Hextile-encoded updates. The Hextile background fill path incorrectly writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch results in an out-of-bounds heap write, which can lead to memory corruption or a denial of service via a process crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.