CVE-2026-50538: CWE-122: Heap-based Buffer Overflow in LibVNC libvncserver
Description
CVE-2026-50538 is a heap-based buffer overflow vulnerability in LibVNCClient versions 0.9.12 through 0.9.15. A malicious or man-in-the-middle VNC server can exploit this flaw by sending a crafted FramebufferUpdate message that causes libvncclient to write attacker-controlled data beyond the framebuffer boundary. This vulnerability requires no authentication and triggers immediately upon connection, causing unconditional client crashes (denial of service) and potentially allowing remote code execution by overwriting application callback pointers. The issue is patched in a commit identified as 540332be3e0acc566fa64da6f1b4680c72c724dd.
CVSS v3.1
Score 8.8high
Affected software
LibVNC
libvncserver
pkg:github/libvnc/libvncserverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LibVNCClient versions 0.9.12 through 0.9.15 contain a heap-based buffer overflow (CWE-122) triggered by a malicious VNC server sending a specially crafted FramebufferUpdate message. This out-of-bounds write is attacker-controlled in length, content, and offset, requiring no authentication and affecting default builds. Exploitation causes immediate client crashes and can lead to arbitrary code execution by overwriting callback pointers. The vulnerability is addressed by a patch in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.
Potential Impact
Exploitation results in unconditional denial of service by crashing the client and can escalate to remote code execution under default configurations. The vulnerability allows an attacker controlling the VNC server to execute arbitrary code on the client system without authentication.
Mitigation Recommendations
A patch addressing this vulnerability is available in commit 540332be3e0acc566fa64da6f1b4680c72c724dd. Users should upgrade libvncclient to a version that includes this fix. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-04T20:37:18.653Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a88c19facd9273b49c12c5e
Added to database: 08/21/2026, 21:22:39 UTC
Last enriched: 09/10/2026, 15:48:51 UTC
Last updated: 10/05/2026, 18:48:20 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.