Out-of-bounds Read in Libvnc Libvncserver
CVE-2026-32853
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (35.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Libvnc Libvncserver — versions 0, 009008e2f4d5a54dd71f422070df3af7b3dbc931
- Libvncserver Project
Weakness classification (CWE)
References
- github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj (vendor-advisory, Vendor Advisory)
- github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931 (Patch, patch)
- www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-… (Exploit, Vendor Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-32853?
- CVE-2026-32853 is a high-severity vulnerability in Libvnc Libvncserver, classified under Out-of-bounds Read. CVSS score: 8.1/10. Published 2026-03-24.
- How severe is CVE-2026-32853?
- High severity. CVSS v3 base score is 8.1 out of 10.