CVE-2026-50538
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
LibVNCClient, a library for easy implementation of a VNC client, in versions 0.9.12 through 0.9.15, contains a vulnerability that allows a malicious (or man-in-the-middle) VNC server to force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It requires no authentication, works in a default build, and can crash the client or lead to code execution. The issue is patched in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.
Risk Assessment
An attacker can cause a client crash (denial of service) or take control of the client process, potentially leading to arbitrary code execution on the victim's system.
Recommendation
It is recommended to immediately upgrade LibVNCClient to a version containing the fix (commit 540332be3e0acc566fa64da6f1b4680c72c724dd) or later, and avoid connecting to untrusted VNC servers.
Related vulnerabilities
- CVE-2026-4813Critical
A vulnerability in the XSL export module of Lutece Core up to version 7.1.7 allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
- CVE-2026-78319Critical
A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code.
- CVE-2026-83772Critical
A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. The issue affects the function c_set_reports_decode of the file mail-report.sh in the JSON Parsing component. Manipulation of the argument sender/recipients results in command injection. The attack can be launched remotely. The exploit is public and may be used. The vendor was contacted but did not respond.
- CVE-2026-75865Critical
The WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.
- CVE-2026-67394Critical
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. It allows a customer or reseller with shell access to elevate privileges to the root account on the hosting server.
- CVE-2026-83524Critical
A command injection vulnerability was detected in RedPort Optimizer wXa-203, wXa-213, and wXa-223 up to 20260704, affecting the exec function of the file /xgatev1/system/datetime.php in the System Clock component. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-82971Critical
A command injection vulnerability was found in QVidium Opera11 version 3.3.2a26-Ax4x-opera11, affecting an unknown part of the file /cgi-bin/net_tr.cgi in the CGI Script component, through manipulation of the ipaddr argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor has ceased operations and no longer supports these products.
- CVE-2026-82954Critical
A path traversal vulnerability was detected in Dokploy up to version 0.29.7, affecting the writeTraefikConfigInPath function in the file packages/server/src/utils/traefik/application.ts of the Settings component, through manipulation of the path argument. The attack can be launched remotely, and the exploit is public.
- CVE-2026-82226Critical
An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.
- CVE-2026-81780Critical
An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.
Original NVD description (English source)
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.