Description
The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | vnc4 | 4.1.1+X4.3.0-21+etch1 | DSA-1716-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | vnc +1 | 4.1.2-14.el5_3.1 | RHSA-2009:0261 |
| RHEL 4 | vnc +1 | 4.0-12.el4_7.1 | RHSA-2009:0261 |
| RHEL 3 | vnc +1 | 4.0-0.beta4.1.8 | RHSA-2009:0261 |
Advisories 2
- RHSA-2009:0261 Red Hat Security Advisory: vnc security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1716-1 vnc4 - remote code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200903-17 vendor-advisory
- http://www.realvnc.com/products/upgrade.html
- FEDORA-2009-1001 vendor-advisory
- http://www.realvnc.com/products/free/4.1/release-notes.html
- 33689 third-party-advisory
- 34184 third-party-advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1
- 248526 vendor-advisory
- 31832 vdb-entry
- realvnc-cmsgreader-code-execution(45969) vdb-entry
- 33263 vdb-entry
- 32317 third-party-advisory
- ADV-2008-2868 vdb-entry
- [vnc-list] 20081126 VNC Viewer Vulnerability CVE-2008-4770 mailing-list
- realvnc-rfb-protocol-code-execution(47937) vdb-entry
- oval:org.mitre.oval:def:9367 vdb-entry signature
- RHSA-2009:0261 vendor-advisory