Summary
It was discovered that LibVNCServer had a memory leak in the client cleanup
function. An attacker could possibly use this issue to cause LibVNCServer
to consume memory, leading to a denial of service. This issue only affected
Ubuntu 22.04 LTS. (CVE-2020-29260)
It was discovered that LibVNCServer did not properly validate bounds when
handling UltraZip encoding subrectangles. A remote attacker could possibly
use this issue to obtain sensitive information or cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 25.04. (CVE-2026-32853)
It was discovered that LibVNCServer did not properly validate return values
in the HTTP proxy handlers. A remote attacker could possibly use this issue
to cause LibVNCServer to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04.
(CVE-2026-32854)
It was discovered that LibVNCServer did not properly handle Tight encoding
gradient filter rectangles. A remote attacker could use this issue to cause
LibVNCServer to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-44988)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libvncserver | 0.9.13+dfsg-3ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | libvncserver | 0.9.14+dfsg-1ubuntu0.1 |
| Ubuntu · 25.10 | libvncserver | 0.9.15+dfsg-1ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libvncserver | 0.9.15+dfsg-3ubuntu0.1 |
Vulnerabilities 4
-
High 8.8
LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger t…
-
Medium 6.9
LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit im…
-
Medium 6.3
LibVNCServer httpd proxy NULL Pointer Dereference
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially cra…
-
Unscored —
libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().