CVE-2026-32853: libvnc libvncserver Out-of-bounds Read
Vulnerability summary
CVE-2026-32853 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in libvnc libvncserver. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 24-03-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (vulncheck.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu6 products
- italcAll versions (No fix recorded)
- libvncserverAll versions (No fix recorded) | < 0.9.13+dfsg-3ubuntu0.1 | < 0.9.14+dfsg-1ubuntu0.1 | < 0.9.15+dfsg-1ubuntu0.1
- tightvncAll versions (No fix recorded)
- veyonAll versions (No fix recorded)
- vinoAll versions (No fix recorded)
Debian1 product
- libvncserver< 0.9.14+dfsg-1+deb12u1 | < 0.9.15+dfsg-1+deb13u1 | < 0.9.15+dfsg-3
Libvnc1 product
- libvncserver≤ 0.9.15
Libvncserver_project1 product
- libvncserver< 0.9.15
4 vendors · 9 products
References
7 links- www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-readThird Party AdvisoryREPORTExploitVendor Advisory
