CVE-2026-32854: CWE-476 NULL pointer dereference in LibVNC LibVNCServer
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
AI Analysis
Technical Summary
CVE-2026-32854 is a medium severity vulnerability in LibVNCServer (<=0.9.15) involving null pointer dereferences in the HTTP proxy handlers. The flaw is due to lack of validation of strchr() return values in the CONNECT and GET proxy handling code paths inside the httpProcessInput() function in httpd.c. Remote attackers can send specially crafted HTTP requests to trigger these null pointer dereferences, causing the server process to crash and resulting in denial of service. The issue was fixed in commit dc78dee, which presumably adds proper validation to prevent dereferencing null pointers.
Potential Impact
Successful exploitation allows remote attackers to cause a denial of service by crashing the LibVNCServer process when HTTP daemon and proxy features are enabled. There is no indication of code execution or data disclosure from this vulnerability.
Mitigation Recommendations
A fix is available and was introduced in commit dc78dee, which addresses the null pointer dereference by adding proper validation in the HTTP proxy handlers. Users should upgrade to LibVNCServer versions later than 0.9.15 to remediate this issue. Since no vendor advisory or patch link is provided, verify the fix by checking the official LibVNCServer repository or release notes for the commit dc78dee. Until upgraded, disabling HTTP daemon and proxy features can mitigate exposure to this vulnerability.
CVE-2026-32854: CWE-476 NULL pointer dereference in LibVNC LibVNCServer
Description
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
CVSS v4.0
Score 6.3medium
Affected software
pkg:github/libvnc/libvncserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-32854 is a medium severity vulnerability in LibVNCServer (<=0.9.15) involving null pointer dereferences in the HTTP proxy handlers. The flaw is due to lack of validation of strchr() return values in the CONNECT and GET proxy handling code paths inside the httpProcessInput() function in httpd.c. Remote attackers can send specially crafted HTTP requests to trigger these null pointer dereferences, causing the server process to crash and resulting in denial of service. The issue was fixed in commit dc78dee, which presumably adds proper validation to prevent dereferencing null pointers.
Potential Impact
Successful exploitation allows remote attackers to cause a denial of service by crashing the LibVNCServer process when HTTP daemon and proxy features are enabled. There is no indication of code execution or data disclosure from this vulnerability.
Mitigation Recommendations
A fix is available and was introduced in commit dc78dee, which addresses the null pointer dereference by adding proper validation in the HTTP proxy handlers. Users should upgrade to LibVNCServer versions later than 0.9.15 to remediate this issue. Since no vendor advisory or patch link is provided, verify the fix by checking the official LibVNCServer repository or release notes for the commit dc78dee. Until upgraded, disabling HTTP daemon and proxy features can mitigate exposure to this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-03-16T18:11:41.759Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69c2cdd9f4197a8e3b58a8a5
Added to database: 03/24/2026, 17:46:01 UTC
Last enriched: 07/15/2026, 10:51:48 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.