CVE-2026-52722
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder.
Published Jun 15, 2026 · updated Oct 15, 2026
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jun 15, 2026 · OSV.dev
Detected
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Oct 15, 2026 · OSV.dev
Fix available
gst-plugins-bad1.0 fixed in 1.26.2-3+deb13u3; gst-plugins-bad1.0 fixed in 1.28.5-1
Oct 15, 2026 · OSV.dev
Fix available
gst-plugins-bad1.0 fixed in 1.26.2-3+deb13u3
Oct 15, 2026 · OSV.dev
Fix available
gst-plugins-bad1.0 fixed in 1.28.5-1
Oct 15, 2026 · OSV.dev
Updated
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
Affected
- Debian:13 gst-plugins-bad1.00 → 1.26.2-3+deb13u3
- Debian:14 gst-plugins-bad1.00 → 1.28.5-1