Executive brief
LibVNCServer is a widely used library that allows developers to add VNC (remote desktop) capabilities to their applications. A security flaw in how the library handles specific screen update messages allows a malicious VNC server to read sensitive information from the memory of a connecting client or cause the client application to crash. This could lead to the theft of private data or a disruption of service for users connecting to untrusted remote desktops.
Technical details
A heap out-of-bounds read exists in the LibVNCClient component within the HandleUltraZipBPP() function in ultra.c. The vulnerability is caused by improper bounds checking when processing UltraZip-encoded FramebufferUpdate rectangles; specifically, the 'numCacheRects' value is derived directly from attacker-controlled input (rect.r.x) without validation. An attacker acting as a malicious VNC server can provide a large subrectangle count, forcing the client to read beyond the allocated heap buffer during the parsing loop. This can result in the leakage of adjacent heap memory or a denial-of-service condition. The issue is addressed in commit 009008e by adding explicit bounds checks before reading subrectangle headers and calculating raw pixel data sizes.
Affected products
- LibVNC LibVNCServer <= 0.9.15
Timeline
- 2026-03-24: advisory: GHSA-87q7-v983-qwcj published
- 2026-03-24: disclosed
- 2026-03-24: patched: Fixed in commit 009008e