Log in Start free

Vulnerability · Published Mar 24, 2026 · Assigned by VulnCheck

CVE-2026-32853LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

Medium 6.9

In plain English

A medium-severity out-of-bounds read in LibVNCServer from LibVNC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libvncserver0.9.14+dfsg-1+deb12u1DEBIAN-CVE-2026-32853
Debian:13libvncserver0.9.15+dfsg-1+deb13u1DEBIAN-CVE-2026-32853
Debian:14libvncserver0.9.15+dfsg-3DEBIAN-CVE-2026-32853
Ubuntu:22.04:LTSlibvncserver0.9.13+dfsg-3ubuntu0.1USN-8463-1
Ubuntu:22.04:LTSlibvncserver0.9.13+dfsg-3ubuntu0.1UBUNTU-CVE-2026-32853
Ubuntu:24.04:LTSlibvncserver0.9.14+dfsg-1ubuntu0.1USN-8463-1
Ubuntu:24.04:LTSlibvncserver0.9.14+dfsg-1ubuntu0.1UBUNTU-CVE-2026-32853
Ubuntu:25.10libvncserver0.9.15+dfsg-1ubuntu0.1USN-8463-1
Ubuntu:25.10libvncserver0.9.15+dfsg-1ubuntu0.1UBUNTU-CVE-2026-32853
Ubuntu:26.04:LTSlibvncserver0.9.15+dfsg-3ubuntu0.1USN-8463-1
Ubuntu:22.04:LTStightvncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:24.04:LTStightvncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:25.10tightvncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.04:LTStightvncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.10tightvncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:22.04:LTSveyonno fix listedUBUNTU-CVE-2026-32853
Ubuntu:24.04:LTSveyonno fix listedUBUNTU-CVE-2026-32853
Ubuntu:25.10veyonno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.04:LTSveyonno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.10veyonno fix listedUBUNTU-CVE-2026-32853
Ubuntu:22.04:LTSvinono fix listedUBUNTU-CVE-2026-32853
Ubuntu:24.04:LTSvinono fix listedUBUNTU-CVE-2026-32853
Ubuntu:25.10vinono fix listedUBUNTU-CVE-2026-32853
Ubuntu:22.04:LTSx11vncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:24.04:LTSx11vncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:25.10x11vncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.04:LTSx11vncno fix listedUBUNTU-CVE-2026-32853
Ubuntu:26.10x11vncno fix listedUBUNTU-CVE-2026-32853

Affected products (as reported)

VendorProductVersions
LibVNC LibVNCServer 0 – through 0.9.15

Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References