Threats affecting pkg:github/libvnc/libvncserver

CVE-2026-50538 is a heap-based buffer overflow vulnerability in LibVNCClient versions 0.9.12 through 0.9.15. A malicious or man-in-the-middle VNC server can exploit this flaw by sending a crafted FramebufferUpdate message that causes libvncclient to write attacker-controlled data beyond the framebuffer boundary. This vulnerability requires no authentication and triggers immediately upon connection, causing unconditional client crashes (denial of service) and potentially allowing remote code execution by overwriting application callback pointers. The issue is patched in a commit identified as 540332be3e0acc566fa64da6f1b4680c72c724dd.

LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.