Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-59691: A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gstreamer-plugins-bad-free | 0:0.10.23-42.amzn2.0.5 |
| Amazon Linux · 2 | gstreamer-plugins-bad-free-debuginfo | 0:0.10.23-42.amzn2.0.5 |
| Amazon Linux · 2 | gstreamer-plugins-bad-free-devel | 0:0.10.23-42.amzn2.0.5 |
| Amazon Linux · 2 | gstreamer-plugins-bad-free-devel-docs | 0:0.10.23-42.amzn2.0.5 |
Vulnerabilities 1
-
High 7.1
Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel value…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59691.html