CVE-2026-44988

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44988", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T16:23:33.265Z", "datePublished": "2026-05-27T14:26:50.063Z", "dateUpdated": "2026-05-29T15:16:13.607Z"}, "containers": {"cna": {"title": "LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58"}, {"name": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1", "tags": ["x_refsource_MISC"], "url": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1"}], "affected": [{"vendor": "LibVNC", "product": "libvncserver", "versions": [{"version": "<= 0.9.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:26:50.063Z"}, "descriptions": [{"lang": "en", "value": "LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1."}], "source": {"advisory": "GHSA-jcc5-8wj4-7c58", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T03:55:55.774539Z", "id": "CVE-2026-44988", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T15:16:13.607Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44988", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T03:55:55.774539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T14:24:40.414Z"}}], "cna": {"title": "LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes", "source": {"advisory": "GHSA-jcc5-8wj4-7c58", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "LibVNC", "product": "libvncserver", "versions": [{"status": "affected", "version": "<= 0.9.15"}]}], "references": [{"url": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58", "name": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1", "name": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T14:26:50.063Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44988", "state": "PUBLISHED", "dateUpdated": "2026-05-29T15:16:13.607Z", "dateReserved": "2026-05-08T16:23:33.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T14:26:50.063Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libvncserver", "vendor": "LibVNC", "versions": [{"status": "affected", "version": "<= 0.9.15"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1."}, {"lang": "es", "value": "LibVNCClient es una biblioteca para la f\u00e1cil implementaci\u00f3n de un cliente VNC. En 0.9.15 y versiones anteriores, el decodificador de codificaci\u00f3n Tight de LibVNCClient utiliza b\u00faferes temporales de tama\u00f1o fijo de 2048 p\u00edxeles para el filtro Gradient, pero no rechaza los rect\u00e1ngulos Tight cuyo ancho es mayor de 2048 p\u00edxeles. Un servidor VNC malicioso puede enviar un rect\u00e1ngulo FramebufferUpdate manipulado utilizando codificaci\u00f3n Tight con NoZlib | ExplicitFilter y el filtro Gradient. Cuando un cliente basado en LibVNCClient se conecta, el cliente procesa el ancho del rect\u00e1ngulo controlado por el servidor y escribe m\u00e1s all\u00e1 de los b\u00faferes Gradient de tama\u00f1o fijo. Esta vulnerabilidad se corrige con el commit 5b270544b85233668b98161323297d418a8f5fd1."}], "id": "CVE-2026-44988", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44988", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-29T03:55:55.774539Z", "version": "2.0.3"}}]}, "published": "2026-05-27T15:16:29.830", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1"}, {"source": "security-advisories@github.com", "url": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.15]"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "libvncserver", "source": "cna", "vendor": "LibVNC"}, "product": "libvncserver", "vendor": "libvncserver"}], "created": "2026-05-27T21:15:25.921719+00:00", "updated": "2026-05-30T21:15:25.718637+00:00", "vendors": ["libvncserver", "libvncserver$PRODUCT$libvncserver"]}