Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2026-32854

LibVNCServer httpd proxy NULL Pointer Dereference

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

CVSS 4.0 · 6.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Libvnc Project Libvncserver Libvncserver Project
Products
Libvncserver Libvncserver Libvncserver
CVE-2026-32853

LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libvnc Project Libvncserver Libvncserver Project
Products
Libvncserver Libvncserver Libvncserver
CVE-2020-14398

libvncserver: an improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c

An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 2 more
Products
Ubuntu Linux Debian Linux Libvncserver and 13 more
CVE-2019-20788

libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in HandleCursorShape function

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 2 more
Products
Ubuntu Linux Debian Linux Libvncserver and 14 more
CVE-2019-15681

libvncserver: information disclosure and ASLR bypass

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 12 more
CVE-2018-6307

libvncserver: Use-after-free in file transfer extension server code allows for potential code execution

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

CVSS 3.0 · 8.1 High EPSS 26.5% KEV · Not listed
Vendors
Canonical Debian Libvnc Project
Products
Ubuntu Linux Debian Linux Libvncserver
CVE-2018-21247

libvncserver: uninitialized memory contents are vulnerable to Information Leak

An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 3 more
Products
Ubuntu Linux Debian Linux Libvncserver and 14 more
CVE-2018-20750

libvncserver: Heap out-of-bounds write in rfbserver.c in rfbProcessFileTransferReadBuffer() allows for potential code execution (Incomplete fix for CVE-2018-15127)

LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 12 more
CVE-2018-20749

libvncserver: Heap out-of-bounds write in rfbserver.c in rfbProcessFileTransferReadBuffer() allows for potential code execution (Incomplete fix for CVE-2018-15127)

LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 12 more
CVE-2018-20748

libvncserver: Multiple heap out-of-bound writes in VNC client code (Incomplete fix for CVE-2018-20019)

LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 12 more
CVE-2018-20023

libvncserver: Improper initialization in VNC Repeater client code allows for information disclosure

LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Libvnc Project
Products
Ubuntu Linux Debian Linux Libvncserver