CVE-2026-32854: libvncserver project libvncserver

csirt@kutim:~/threat-intel/cve/CVE-2026-32854

CVSS 7.5 · High EPSS 5,3%

Kerentanan NULL Pointer Dereference pada libvncserver project libvncserver. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

Rincian

Terbit di NVD: 24 Maret 2026
Terakhir diubah: 14 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 5,3% peluang dieksploitasi; lebih tinggi dari 92,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
libvncserver project	libvncserver	Semua versi sebelum 0.9.15

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x exploit · advisory vendor
https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 patch
https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.