CVE-2016-9941

Critical

Published: 31/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A heap-based buffer overflow in LibVNCClient in LibVNCServer before version 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message.

Risk Assessment

This vulnerability can lead to service outages, affecting application availability. There is also a risk of arbitrary code execution, which may compromise system security.

Recommendation

It is recommended to update LibVNCServer to version 0.9.11 or later to mitigate this vulnerability. Additionally, monitoring and restricting access to VNC servers is advisable.

Original NVD description (English source)

Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.