Executive brief
LibVNCClient is a library that allows applications to connect to and display VNC remote desktop servers. A malicious or compromised VNC server can exploit a flaw in the Tight image decompression logic to write attacker-controlled data past the end of the client's framebuffer memory. This can crash the client (denying access to the remote desktop), and under certain conditions, redirect execution to attacker-supplied code on the victim's machine—all triggered automatically when the user connects, before any authentication occurs.
Technical details
The vulnerability is an out-of-bounds heap write (CWE-787/CWE-122) in the Tight decoder's HandleTightBPP() function (src/libvncclient/tight.c). The basic-compression decompression loop writes decompressed rows directly to the framebuffer via filterFn() and only validates the total row count against the declared rectangle height after the loop completes—too late. A malicious server sends a zlib-compressed FramebufferUpdate rectangle with legitimate declared dimensions but a zlib payload that decompresses to more rows than declared, causing the write index to exceed framebuffer bounds. The vulnerability is network-reachable pre-authentication, requires no user interaction, works in default builds (Tight is advertised when zlib+libjpeg are enabled), and fires immediately upon connection. The attack can cause denial of service (crash) or, by overwriting adjacent callback pointers, achieve code execution. The patch (commit 540332be3e0acc) clamps the decompressed row count to the remaining rectangle height before calling filterFn, matching the pattern already used in the trle.c and Tight JPEG decoders.
Affected products
- LibVNC libvncclient 0.9.12 through 0.9.15
Timeline
- 2026-05-29: disclosed: GitHub Security Advisory GHSA-v9pm-47h4-jcq8 published
- 2026: patched: Patch available in commit 540332be3e0acc566fa64da6f1b4680c72c724dd