CVE-2026-59691: gst-plugins-bad1.0 Out-of-bounds Write

Vulnerability summary

CVE-2026-59691 is a high (CVSS 7.1) Out-of-bounds Write vulnerability in gst-plugins-bad1.0. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Timeline

1. 09-07-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.