CVE-2026-32854

< 0.9.15

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP pro

7.5HIGH

CVE-2026-32853

< 0.9.15

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip

8.1HIGH

CVE-2020-29260

all versions

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

7.5HIGH

CVE-2020-25708

all versions

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially craft

7.5HIGH

CVE-2017-18922

< 0.9.12

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious

9.8CRITICAL

CVE-2020-14405

< 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.

6.5MEDIUM

CVE-2020-14404

< 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.

5.4MEDIUM

CVE-2020-14403

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.

5.4MEDIUM

CVE-2020-14402

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.

5.4MEDIUM

CVE-2020-14401

< 0.9.13

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.

6.5MEDIUM

CVE-2020-14400

< 0.9.13

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/tra

7.5HIGH

CVE-2020-14399

< 0.9.13

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfb

7.5HIGH

CVE-2020-14398

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient

7.5HIGH

CVE-2020-14397

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.

7.5HIGH

CVE-2020-14396

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.

7.5HIGH

CVE-2019-20840

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses

7.5HIGH

CVE-2019-20839

<= 0.9.12

libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

7.5HIGH

CVE-2018-21247

<= 0.9.12

An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libv

7.5HIGH

CVE-2019-20788

<= 0.9.12

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a

9.8CRITICAL

CVE-2010-5304

< 0.9.9

A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote att

7.5HIGH

CVE-2019-15681

< 0.9.12

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an

7.5HIGH

CVE-2018-20750

< 0.9.12

LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 wa

9.8CRITICAL

CVE-2018-20749

< 0.9.12

LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was

9.8CRITICAL

CVE-2018-20748

< 0.9.12

LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-2

9.8CRITICAL

CVE-2018-6307

< 0.9.12

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file tr

8.1HIGH

CVE-2018-20024

< 0.9.12

LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result

7.5HIGH

CVE-2018-20023

< 0.9.12

LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater cli

7.5HIGH

CVE-2018-20022

< 0.9.12

LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability

7.5HIGH

CVE-2018-20021

< 0.9.12

LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code.

7.5HIGH

CVE-2018-20020

< 0.9.12

LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in V

9.8CRITICAL

CVE-2018-20019

< 0.9.12

LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC cli

9.8CRITICAL

CVE-2018-15127

< 0.9.12

LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of fil

9.8CRITICAL

CVE-2018-15126

< 0.9.12

LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file tr

9.8CRITICAL

CVE-2018-7225

<= 0.9.11

An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.l

9.8CRITICAL

CVE-2016-9942

all versions

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of ser

9.8CRITICAL

CVE-2016-9941

<= 0.9.10

Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of

9.8CRITICAL

CVE-2014-6053

<= 0.9.9

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle

CVE-2014-6052

<= 0.9.9

The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc ret

CVE-2014-6054

<= 0.9.9

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers t

CVE-2014-6055

<= 0.9.9

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote a

CVE-2014-6051

<= 0.9.9

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to c

CVE-2006-2450

all versions

auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insec