LibVNCClient versions 0.9.12 through 0.9.15 contain a heap-based buffer overflow (CWE-122) triggered by a malicious VNC server sending a specially crafted FramebufferUpdate message. The overflow allows attacker-controlled length, content, and offset to write past the framebuffer's end. This vulnerability requires no authentication since the attacker acts as the server and triggers upon connection. Exploitation can cause unconditional client crashes or, under default configurations, remote code execution by overwriting callback pointers. The issue was patched in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.

An attacker controlling a VNC server can cause any connecting vulnerable libvncclient to crash immediately, resulting in denial of service. Additionally, the attacker can achieve remote code execution by overwriting function pointers, leading to full compromise of the client application. No authentication is required, and exploitation occurs immediately upon connection.

A patch fixing this vulnerability was committed (commit 540332be3e0acc566fa64da6f1b4680c72c724dd). Users should upgrade libvncclient to a version later than 0.9.15 where this issue is resolved. Since no official remediation level or vendor advisory is provided, check the official LibVNC project repository or vendor channels for the patched release. Until patched, avoid connecting to untrusted or potentially malicious VNC servers.