What’s Vulnerable › Vulnerabilities

CVE-2026-32853: LibVNCServer UltraZip Encoding Heap Out-of-bounds Read

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-07-14
• Weakness: CWE-125

Description

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Affected products

• LibVNCServer: before 0.9.15 — fixed in 0.9.15

How to fix

Upgrade to a fixed version: LibVNCServer 0.9.15. Check the vendor advisory for mitigations.

References

• https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931
• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
• https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read
• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj

Get alerted when CVE-2026-32853 or the next vulnerability affects your stack