CVE-2026-32853

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32853
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 Patch
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj Vendor Advisory
https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read Exploit Vendor Advisory
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:36

Type Values Removed Values Added
Summary
  • (es) Las versiones 0.9.15 y anteriores de LibVNCServer (corregido en el commit 009008e) contienen una vulnerabilidad de lectura fuera de límites de la pila en el gestor de codificación UltraZip que permite a un servidor VNC malicioso causar revelación de información o un fallo de la aplicación. Los atacantes pueden explotar la comprobación de límites incorrecta en la función HandleUltraZipBPP() manipulando los recuentos de encabezados de subrectángulos para leer más allá del búfer de pila asignado.

25 Mar 2026, 20:48

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
First Time Libvncserver Project libvncserver
Libvncserver Project
CPE cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:*
References () https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 - () https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 - Patch
References () https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj - () https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj - Vendor Advisory
References () https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read - () https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read - Exploit, Vendor Advisory

25 Mar 2026, 14:16

Type Values Removed Values Added
References () https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj - () https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj -

24 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-24 18:16

Updated : 2026-06-17 10:36

NVD link : CVE-2026-32853

Mitre link : CVE-2026-32853

CVE.ORG link : CVE-2026-32853

JSON object : View

Products Affected

libvncserver_project

  • libvncserver
CWE
CWE-125

Out-of-bounds Read