GHSA-87q7-v983-qwcj: LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

Q: What does an attacker need to control to trigger this issue?

The attacker needs to operate or control a malicious VNC server that sends crafted UltraZip encoding data. Exploitation uses manipulated subrectangle header counts processed by HandleUltraZipBPP().

Q: Which installations should be prioritized for remediation?

Prioritize LibVNCServer versions 0.9.15 and earlier where the application may connect to untrusted or attacker-controlled VNC servers. The reported impacts are information disclosure and application crashes.

Q: How can I determine whether a build is affected?

Check whether the deployed LibVNCServer version is 0.9.15 or earlier and whether its source includes the fix from commit 009008e. Builds incorporating that commit are identified as fixed in the advisory data.

Published Mar 24, 2026

Updated

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Affected Software

1 affected component

LibVNCServer LibVNCServer<=0.9.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LibVNCServer to a version that resolves this vulnerability.
Patch 009008e

Event History

Mar 24, 2026

CVE Published

via OSV·05:30 PM

Data Sourced

via OSV·05:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to control to trigger this issue?

The attacker needs to operate or control a malicious VNC server that sends crafted UltraZip encoding data. Exploitation uses manipulated subrectangle header counts processed by HandleUltraZipBPP().

Which installations should be prioritized for remediation?

Prioritize LibVNCServer versions 0.9.15 and earlier where the application may connect to untrusted or attacker-controlled VNC servers. The reported impacts are information disclosure and application crashes.

How can I determine whether a build is affected?

Check whether the deployed LibVNCServer version is 0.9.15 or earlier and whether its source includes the fix from commit 009008e. Builds incorporating that commit are identified as fixed in the advisory data.

GHSA-87q7-v983-qwcj: LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to control to trigger this issue?

Which installations should be prioritized for remediation?

How can I determine whether a build is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to control to trigger this issue?

Which installations should be prioritized for remediation?

How can I determine whether a build is affected?