LibVNCClient's Tight encoding decoder in versions up to 0.9.15 uses fixed-size 2048-pixel scratch buffers for the Gradient filter but fails to reject rectangles wider than 2048 pixels. This allows a malicious VNC server to send a crafted FramebufferUpdate rectangle with Tight encoding using NoZlib | ExplicitFilter and the Gradient filter, causing an out-of-bounds write when the client processes the rectangle width. The vulnerability is identified as CWE-787 (Out-of-bounds Write) and has a CVSS 3.1 score of 8.8, indicating high severity. The issue is resolved in a specific commit referenced by the vendor.

Successful exploitation allows a malicious VNC server to cause out-of-bounds writes in the LibVNCClient-based client, potentially leading to memory corruption. This can result in compromise of confidentiality, integrity, and availability of the client system. No known exploits are currently reported in the wild.

A fix for this vulnerability exists as indicated by the referenced commit (5b270544b85233668b98161323297d418a8f5fd1). Users should update LibVNCClient/libvncserver to a version that includes this fix. Patch status is not explicitly stated in the advisory, so users should verify the availability of updated versions or patches from the vendor or source repository before deployment.