Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-32854

LibVNCServer httpd proxy NULL Pointer Dereference

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

CVSS 4.0 · 6.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Libvnc Project Libvncserver Libvncserver Project
Products
Libvncserver Libvncserver Libvncserver
CVE-2026-32853

LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libvnc Project Libvncserver Libvncserver Project
Products
Libvncserver Libvncserver Libvncserver
CVE-2016-9941

libvncserver: Heap-based buffer overflow in rfbproto.c

Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Libvncserver Project
Products
Libvncserver
CVE-2016-9942

libvncserver: Heap-based buffer overflow in ultra.c

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Libvncserver Project
Products
Libvncserver
CVE-2020-25708

libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Libvncserver Project Redhat
Products
Debian Linux Libvncserver Enterprise Linux
CVE-2020-14400

libvncserver: byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libvncserver Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 1 more
CVE-2020-14399

libvncserver: byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libvncserver Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 1 more
CVE-2018-7225

libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c

An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed
Vendors
Canonical Debian Libvncserver Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 7 more
CVE-2017-18922

libvncserver: websocket decoding buffer overflow

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed
Vendors
Canonical Fedoraproject Libvncserver Project and 3 more
Products
Ubuntu Linux Fedora Libvncserver and 16 more
CVE-2010-5304

realvnc: Null pointer dereference flaw in ClientCutText message handling

A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Fedoraproject Libvncserver Project
Products
Fedora Libvncserver