CVE-2014-6051
HighSummary
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
Risk Assessment
This vulnerability can lead to VNC service crashes and allow attackers to execute malicious code, posing a serious security threat to systems using LibVNCServer.
Recommendation
It is recommended to update LibVNCServer to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.
Other vulnerabilities in LibVNCServer
See all- CVE-2014-6052High
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer version 0.9.9 and earlier does not check certain malloc return values, allowing remote VNC servers to cause application crashes or potentially execute arbitrary code by specifying a large screen size in FramebufferUpdate, ResizeFrameBuffer, or PalmVNCReSizeFrameBuffer messages.
- CVE-2026-32854High
In LibVNCServer versions 0.9.15 and prior, a null pointer dereference vulnerability exists in the httpProcessInput() function in httpd.c. Attackers can send specially crafted HTTP requests to exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths, causing a denial of service.
- CVE-2026-32853High
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler. Improper bounds checking in the HandleUltraZipBPP() function allows a malicious VNC server to manipulate subrectangle header counts and read beyond the allocated heap buffer.
Original NVD description (English source)
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.