CVE-2026-32854: LibVNCServer httpd proxy NULL Pointer Dereference
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibVNCServerto a version that resolves this vulnerability.Patch dc78dee
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32854?
CVE-2026-32854 is classified as a denial of service vulnerability, allowing remote attackers to crash the server.
How do I fix CVE-2026-32854?
To fix CVE-2026-32854, upgrade LibVNCServer to version 0.9.16 or later.
What software is affected by CVE-2026-32854?
CVE-2026-32854 affects LibVNCServer versions 0.9.15 and earlier.
What type of vulnerability is CVE-2026-32854?
CVE-2026-32854 is a null pointer dereference vulnerability in the HTTP proxy handlers of LibVNCServer.
Can CVE-2026-32854 be exploited remotely?
Yes, CVE-2026-32854 can be exploited remotely, allowing attackers to cause a denial of service.