Threat Intelligence Database

CVE-2026-50538 is a heap-based buffer overflow vulnerability in LibVNCClient versions 0.9.12 through 0.9.15. A malicious or man-in-the-middle VNC server can exploit this flaw by sending a crafted FramebufferUpdate message that causes libvncclient to write attacker-controlled data beyond the framebuffer boundary. This vulnerability requires no authentication and triggers immediately upon connection, causing unconditional client crashes (denial of service) and potentially allowing remote code execution by overwriting application callback pointers. The issue is patched in a commit identified as 540332be3e0acc566fa64da6f1b4680c72c724dd.

LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-32853#cwe-125