LibVNCServer vulnerabilities
4 known CVE vulnerabilities in LibVNCServer, translated and rated.
- CVE-2014-6052High
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer version 0.9.9 and earlier does not check certain malloc return values, allowing remote VNC servers to cause application crashes or potentially execute arbitrary code by specifying a large screen size in FramebufferUpdate, ResizeFrameBuffer, or PalmVNCReSizeFrameBuffer messages.
- CVE-2014-6051High
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
- CVE-2026-32854High
In LibVNCServer versions 0.9.15 and prior, a null pointer dereference vulnerability exists in the httpProcessInput() function in httpd.c. Attackers can send specially crafted HTTP requests to exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths, causing a denial of service.
- CVE-2026-32853High
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler. Improper bounds checking in the HandleUltraZipBPP() function allows a malicious VNC server to manipulate subrectangle header counts and read beyond the allocated heap buffer.