CVE-2016-9942

Critical

Published: 31/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A heap-based buffer overflow in LibVNCClient in LibVNCServer before version 0.9.11 can be exploited by remote servers. An attacker can cause application crashes or potentially execute arbitrary code by sending a crafted FramebufferUpdate message with the Ultra type.

Risk Assessment

This vulnerability can lead to denial of service and allow remote code execution, posing a significant security threat to the system.

Recommendation

It is recommended to upgrade to LibVNCServer version 0.9.11 or later to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Original NVD description (English source)

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.