CVE-2026-32853 is a heap out-of-bounds read vulnerability in LibVNCServer versions 0.9.15 and prior, specifically in the UltraZip encoding handler. The issue stems from insufficient bounds checking in the HandleUltraZipBPP() function, which processes subrectangle header counts. An attacker controlling a malicious VNC server can exploit this to read beyond allocated heap buffers, potentially causing information disclosure or application crashes. The vulnerability was fixed in a commit identified as 009008e. No known exploits are reported in the wild.

Successful exploitation can lead to information disclosure or application crashes due to heap out-of-bounds reads. This may affect the confidentiality and availability of applications using vulnerable LibVNCServer versions. There is no indication of privilege escalation or remote code execution from the provided data.

A fix for this vulnerability is available as indicated by the referenced commit 009008e. Users should update LibVNCServer to a version including this fix (versions after 0.9.15). Since no official patch link is provided, users should consult the LibVNC project repository or vendor advisory for the exact patched version and update instructions. No additional mitigations are specified.