Skip to main content

LibVNCClient CVE-2026-50538

| EUVDEUVD-2026-64167 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-08-21 security-advisories@github.com
RCE Buffer Overflow Denial Of Service Heap Overflow Suse
8.8
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Attacker is the server requiring no credentials (PR:N); victim must connect (UI:R); demonstrated full code execution under default config justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 21, 2026 - 21:34 vuln.today
Analysis Generated
Aug 21, 2026 - 21:34 vuln.today
CVE Published
Aug 21, 2026 - 21:16 cve.org
HIGH 8.8

DescriptionCVE.org

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single FramebufferUpdate the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.

AnalysisAI

Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the victim's VNC client application is compiled against LibVNCClient versions 0.9.12-0.9.15 with Tight encoding support included, which is the default build configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 score is well-calibrated and consistent with the demonstrated impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The upstream fix is available as commit 540332be3e0acc566fa64da6f1b4680c72c724dd in the LibVNC/libvncserver repository (https://github.com/LibVNC/libvncserver/commit/540332be3e0acc566fa64da6f1b4680c72c724dd); however, no tagged patched release version was confirmed in the provided data, so consumers should verify current release status at the GitHub advisory page (https://github.com/LibVNC/libvncserver/security/advisories/GHSA-v9pm-47h4-jcq8) and apply the patch commit directly if a release is not yet available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all systems running LibVNCClient 0.9.12-0.9.15 and implement network-level controls restricting VNC client connections to explicitly whitelisted trusted internal VNC servers; disable VNC client functionality where not operationally required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Affected

Share

CVE-2026-50538 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy