Description

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T21:16:59.807Z",
  "pubdate": "2026-08-21T21:16:59.807Z",
  "executiveSummary": "An out-of-bounds heap write vulnerability exists in LibVNCClient versions 0.9.12 through 0.9.15, involving the client-side handling of VNC server communications.\nThe vulnerability allows a malicious VNC server or a man-in-the-middle attacker to force a connecting client to write attacker-controlled data past the allocated boundaries of its framebuffer.\nThe flaw affects applications utilizing the LibVNCClient library under default configurations and standard builds.\nExploitation requires no authentication, as the attacker acts as the server during the initial connection phase.\nThe impact includes guaranteed denial of service through application crashes and potential remote code execution via the overwriting of critical application callback pointers and subsequent execution redirection to attacker-chosen payloads.\nThe vulnerability triggers immediately upon connection receipt during the processing of a single FramebufferUpdate message.",
  "technicalDetails": "The vulnerability stems from improper bounds validation within LibVNCClient when processing incoming framebuffer update data sent by a remote VNC server.\nSpecifically, the vulnerable component fails to properly validate the length, contents, and offset parameters associated with data received during a FramebufferUpdate sequence.\nBecause client-side validation is absent or insufficient, an attacker-controlled VNC server can supply arbitrary write parameters that direct the client to perform an out-of-bounds heap write directly past the end of the allocated framebuffer buffer.\nThe attack flow proceeds as follows: 1) A victim initiates a connection to a malicious or compromised VNC server; 2) The server responds with a crafted FramebufferUpdate message containing malicious parameters specifying attacker-controlled length, contents, and offset values; 3) The client processes the message without adequate bounds checking; 4) LibVNCClient writes the payload into the heap memory beyond the boundaries of the framebuffer.\nThis behavior requires no prior authentication or user privileges beyond the victim establishing a connection to the server, and it functions within the default network exposure and default settings of the library.\nThe post-exploitation impact ranges from unconditional application termination, resulting in a denial of service, to arbitrary code execution achieved by precisely overwriting adjacent heap structures, such as application callback pointers, to redirect control flow to attacker-supplied machine instructions."
}