CVE-2026-32854

HighCVSS 7.5

Published: 24/03/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.32%

92th percentile - higher than 92% of all known CVEs

Summary

In LibVNCServer versions 0.9.15 and prior, a null pointer dereference vulnerability exists in the httpProcessInput() function in httpd.c. Attackers can send specially crafted HTTP requests to exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths, causing a denial of service.

Risk Assessment

The risk is a remote denial of service (DoS) attack via crafted HTTP requests when httpd and proxy features are enabled. This can disrupt VNC-based remote access services.

Recommendation

Update LibVNCServer to a version containing the fix (commit dc78dee) or later. If updating is not possible, disable the httpd and proxy features in the server configuration.

Original NVD description (English source)

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.