CVE-2026-50538: libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single FramebufferUpdate the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Any application using LibVNCClient versions 0.9.12 through 0.9.15 is exposed when it connects to an attacker-controlled VNC server or a connection intercepted by a man-in-the-middle. The issue works in a default build with default settings.
What must an attacker do to exploit this?
The attacker only needs to act as the VNC server, or control a server connection through a man-in-the-middle position. No authentication is required, and exploitation is triggered by a single FramebufferUpdate when the victim connects.
What is the practical impact?
A malicious server can cause an unconditional client crash and can write attacker-controlled data, length, and offset beyond the framebuffer allocation. The issue has also been demonstrated overwriting an application callback pointer and redirecting execution to attacker-chosen code under the default configuration.
What remediation is available?
Apply the fix in commit 540332be3e0acc566fa64da6f1b4680c72c724dd. If patching cannot happen immediately, avoid connecting affected clients to untrusted VNC servers and prevent man-in-the-middle access to VNC connections.