Vulnerability · Published May 11, 2026 · Assigned by GitHub_M
CVE-2026-42859Neat VNC: Buffer overflow due to oversized RSA public keys
High 8.1
In plain English
A high-severity buffer overflow in neatvnc from any1. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | neatvnc | no fix listed | DEBIAN-CVE-2026-42859 |
| Debian:13 | neatvnc | no fix listed | DEBIAN-CVE-2026-42859 |
| Debian:14 | neatvnc | 0.9.1+dfsg-1.1 | DEBIAN-CVE-2026-42859 |
| Ubuntu:22.04:LTS | neatvnc | no fix listed | UBUNTU-CVE-2026-42859 |
| Ubuntu:24.04:LTS | neatvnc | no fix listed | UBUNTU-CVE-2026-42859 |
| Ubuntu:25.10 | neatvnc | no fix listed | UBUNTU-CVE-2026-42859 |
| Ubuntu:26.04:LTS | neatvnc | no fix listed | UBUNTU-CVE-2026-42859 |
| Ubuntu:26.10 | neatvnc | no fix listed | UBUNTU-CVE-2026-42859 |
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U