libvncserver vulnerabilities

Latest libvncserver CVEs

Newest publication first

1. CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

   Published 2026-08-21

   High·CVSS 8.8 EPSS 0.40%

   LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap...

2. CVE-2026-44988 LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes

   Published 2026-05-27

   High·CVSS 8.8 EPSS 0.24%

   LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A ma...

3. CVE-2026-32854 LibVNCServer httpd proxy NULL Pointer Dereference

   Published 2026-03-24

   Medium·CVSS 6.3 EPSS 5.5%

   LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. A...

4. CVE-2026-32853 LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

   Published 2026-03-24

   Medium·CVSS 6.9 EPSS 0.46%

   LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checkin...

5. CVE-2019-15690 LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially cra...

   Published 2025-01-24

   High·CVSS 8.8 EPSS 0.77%

   LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.