https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 04:24:38 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-50538 <p>LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.</p> <p>LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-50538 https://vulnerability.circl.lu/vuln/oesa-2026-3318 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: libvncserver</p> <p>libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to &amp;amp;quot;export&amp;amp;quot; a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself. Security Fix(es):</p> <p>An attacker-controlled heap out-of-bounds write vulnerability exists in the Tight decoder of libvncclient within libvncserver. An attacker can trigger a heap out-of-bounds write via crafted packets, potentially leading to denial of service or remote code execution.(CVE-2026-50538)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: libvncserver</p> <p>libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to &amp;amp;quot;export&amp;amp;quot; a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself. Security Fix(es):</p> <p>An attacker-controlled heap out-of-bounds write vulnerability exists in the Tight decoder of libvncclient within libvncserver. An attacker can trigger a heap out-of-bounds write via crafted packets, potentially leading to denial of service or remote code execution.(CVE-2026-50538)</p> https://vulnerability.circl.lu/vuln/oesa-2026-3318 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11601-1 <p>LibVNCServer-devel-0.9.15-4.1 on GA media</p> <p>LibVNCServer-devel-0.9.15-4.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11601-1 https://vulnerability.circl.lu/vuln/suse-su-2026:23601-1 <p>Security update for LibVNCServer</p> <p>Security update for LibVNCServer</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23601-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-50538 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: tightvnc, Ubuntu:14.04:LTS: x11vnc, Ubuntu:16.04:LTS: libvncserver, Ubuntu:16.04:LTS: vino, Ubuntu:16.04:LTS: italc, Ubuntu:16.04:LTS: tightvnc, Ubuntu:Pro:16.04:LTS: x11vnc, Ubuntu:18.04:LTS: libvncserver, Ubuntu:18.04:LTS: vino, Ubuntu:18.04:LTS: italc and 26 more</p> <p>LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: tightvnc, Ubuntu:14.04:LTS: x11vnc, Ubuntu:16.04:LTS: libvncserver, Ubuntu:16.04:LTS: vino, Ubuntu:16.04:LTS: italc, Ubuntu:16.04:LTS: tightvnc, Ubuntu:Pro:16.04:LTS: x11vnc, Ubuntu:18.04:LTS: libvncserver, Ubuntu:18.04:LTS: vino, Ubuntu:18.04:LTS: italc and 26 more</p> <p>LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-50538