High [CVE-2026-59691] rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels.

This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption. This vulnerability is rated as Important severity because it is a heap out-of-bounds write reachable over the network, though exploitation requires user interaction (connecting to a malicious VNC server).

The rfbsrc plugin is shipped as part of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle Operating System (RHIVOS). A user must actively connect a GStreamer pipeline to a malicious RFB/VNC server to trigger this vulnerability.

Code execution has not been demonstrated but cannot be ruled out for heap overflows. This is in the same code area as CVE-2026-52720, a few lines further down.

Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). Weakness: CWE-787.