Log in Start free

Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44988LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes

High 8.8

In plain English

A high-severity out-of-bounds write in libvncserver from LibVNC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.2%top 84.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libvncserver0.9.14+dfsg-1+deb12u2DEBIAN-CVE-2026-44988
Debian:13libvncserver0.9.15+dfsg-1+deb13u2DEBIAN-CVE-2026-44988
Debian:14libvncserver0.9.15+dfsg-5DEBIAN-CVE-2026-44988
Ubuntu:22.04:LTSlibvncserver0.9.13+dfsg-3ubuntu0.1USN-8463-1
Ubuntu:22.04:LTSlibvncserver0.9.13+dfsg-3ubuntu0.1UBUNTU-CVE-2026-44988
Ubuntu:24.04:LTSlibvncserver0.9.14+dfsg-1ubuntu0.1UBUNTU-CVE-2026-44988
Ubuntu:24.04:LTSlibvncserver0.9.14+dfsg-1ubuntu0.1USN-8463-1
Ubuntu:25.10libvncserver0.9.15+dfsg-1ubuntu0.1UBUNTU-CVE-2026-44988
Ubuntu:25.10libvncserver0.9.15+dfsg-1ubuntu0.1USN-8463-1
Ubuntu:26.04:LTSlibvncserver0.9.15+dfsg-3ubuntu0.1USN-8463-1
Ubuntu:26.04:LTSlibvncserver0.9.15+dfsg-3ubuntu0.1UBUNTU-CVE-2026-44988
Ubuntu:22.04:LTStightvncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:24.04:LTStightvncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:25.10tightvncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.04:LTStightvncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.10tightvncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:22.04:LTSveyonno fix listedUBUNTU-CVE-2026-44988
Ubuntu:24.04:LTSveyonno fix listedUBUNTU-CVE-2026-44988
Ubuntu:25.10veyonno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.04:LTSveyonno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.10veyonno fix listedUBUNTU-CVE-2026-44988
Ubuntu:22.04:LTSvinono fix listedUBUNTU-CVE-2026-44988
Ubuntu:24.04:LTSvinono fix listedUBUNTU-CVE-2026-44988
Ubuntu:25.10vinono fix listedUBUNTU-CVE-2026-44988
Ubuntu:22.04:LTSx11vncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:24.04:LTSx11vncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:25.10x11vncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.04:LTSx11vncno fix listedUBUNTU-CVE-2026-44988
Ubuntu:26.10x11vncno fix listedUBUNTU-CVE-2026-44988

Affected products (as reported)

VendorProductVersions
LibVNC libvncserver <= 0.9.15

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References