CVE-2026-32854
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
In LibVNCServer versions 0.9.15 and prior, a null pointer dereference vulnerability exists in the httpProcessInput() function in httpd.c. Attackers can send specially crafted HTTP requests to exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths, causing a denial of service.
Risk Assessment
The risk is a remote denial of service (DoS) attack via crafted HTTP requests when httpd and proxy features are enabled. This can disrupt VNC-based remote access services.
Recommendation
Update LibVNCServer to a version containing the fix (commit dc78dee) or later. If updating is not possible, disable the httpd and proxy features in the server configuration.
Other vulnerabilities in LibVNCServer
See all- CVE-2014-6052High
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer version 0.9.9 and earlier does not check certain malloc return values, allowing remote VNC servers to cause application crashes or potentially execute arbitrary code by specifying a large screen size in FramebufferUpdate, ResizeFrameBuffer, or PalmVNCReSizeFrameBuffer messages.
- CVE-2014-6051High
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
- CVE-2026-32853High
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler. Improper bounds checking in the HandleUltraZipBPP() function allows a malicious VNC server to manipulate subrectangle header counts and read beyond the allocated heap buffer.
Original NVD description (English source)
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.