CVE-2026-32853
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler. Improper bounds checking in the HandleUltraZipBPP() function allows a malicious VNC server to manipulate subrectangle header counts and read beyond the allocated heap buffer.
Risk Assessment
An attacker can exploit this vulnerability to disclose sensitive information from memory or cause a crash of the VNC client application, potentially leading to data leakage or service disruption.
Recommendation
Immediately update LibVNCServer to a version containing the fix (commit 009008e) or later. If updating is not possible, restrict VNC connections to trusted servers only.
Other vulnerabilities in LibVNCServer
See all- CVE-2014-6052High
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer version 0.9.9 and earlier does not check certain malloc return values, allowing remote VNC servers to cause application crashes or potentially execute arbitrary code by specifying a large screen size in FramebufferUpdate, ResizeFrameBuffer, or PalmVNCReSizeFrameBuffer messages.
- CVE-2014-6051High
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
- CVE-2026-32854High
In LibVNCServer versions 0.9.15 and prior, a null pointer dereference vulnerability exists in the httpProcessInput() function in httpd.c. Attackers can send specially crafted HTTP requests to exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths, causing a denial of service.
Original NVD description (English source)
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.