Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-52722 →

DEBIAN-CVE-2026-52722

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:13 gst-plugins-bad1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3+deb13u3"}]}]

Debian:14 gst-plugins-bad1.0

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.5-1"}]}]

Références

advisory security-tracker.debian.org