CVE-2026-32853

Katalog CVE

CVSS 8.1 · High EPSS 0,44%

Kerentanan Out-of-bounds Read pada libvncserver project libvncserver. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj advisory vendor
• https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read exploit · advisory vendor
• https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 patch