CVE-2026-44988: libvnc libvncserver Out-of-bounds Write
Vulnerability summary
CVE-2026-44988 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in libvnc libvncserver. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 27-05-2026PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
+0.20 pp
From 0.24% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse6 products
- LibVNCServer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 0.9.14-150600.3.9.1
- LibVNCServer&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 0.9.9-17.47.1
- LibVNCServer&distro=SUSE Linux Enterprise Server 16.0< 0.9.14-160000.5.1
- LibVNCServer&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 0.9.14-160000.5.1
- LibVNCServer&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 0.9.9-17.47.1
Ubuntu6 products
- italcAll versions (No fix recorded)
- libvncserverAll versions (No fix recorded) | < 0.9.13+dfsg-3ubuntu0.1 | < 0.9.14+dfsg-1ubuntu0.1 | < 0.9.15+dfsg-1ubuntu0.1 | < 0.9.15+dfsg-3ubuntu0.1
- tightvncAll versions (No fix recorded)
- veyonAll versions (No fix recorded)
- vinoAll versions (No fix recorded)
Opensuse2 products
- LibVNCServer&distro=openSUSE Leap 16.0< 0.9.14-160000.5.1
- LibVNCServer&distro=openSUSE Tumbleweed< 0.9.15-3.1
Debian1 product
- libvncserver< 0.9.14+dfsg-1+deb12u2 | < 0.9.15+dfsg-1+deb13u2 | < 0.9.15+dfsg-5
Libvnc1 product
- libvncserver≤ 0.9.15
5 vendors · 16 products
