Executive brief
Neat VNC is a software library used to provide remote desktop access (VNC) capabilities to applications. A security flaw allows an unauthenticated attacker to crash the VNC server or potentially take control of the system by sending a specially crafted security handshake. This could lead to a total service outage or unauthorized access to the host machine.
Technical details
A stack-based buffer overflow exists in the RSA-AES security type handler of Neat VNC. The vulnerability is located in the `rsa_aes_send_challenge` function within `src/auth/rsa-aes.c`. An unauthenticated remote attacker can trigger the overflow by sending a crafted security type 5 (RSA-AES) or type 129 (RSA-AES-256) handshake containing an oversized RSA public key. This exceeds a 1024-byte on-stack buffer during the encryption of the server challenge. Successful exploitation can lead to a denial of service (server crash) or potentially arbitrary code execution. The issue is fixed in version 0.9.6 by implementing dynamic allocation and size validation for public keys.
Affected products
- any1 Neat VNC < 0.9.6
Timeline
- 2026-04-24: advisory: GitHub security advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix committed to repository