CVE-2017-5884

What it actually does

Buffer overflow in gtk-vnc tile decoding path caused by missing bounds checks on src x/y coordinates inside RRE, hextile, and copyrect subrectangle tiles, enabling arbitrary code execution when a client processes a malicious tile.

Why it matters to the business

Compromise of any system that uses the vulnerable VNC client library to connect to an untrusted server, resulting in full host takeover with potential lateral movement and data loss.

How an attack unfolds

An attacker hosts a malicious VNC server that, upon client connection, transmits specially crafted tiles containing out-of-bounds source coordinates; the client library fails to validate the coordinates before memory operations, triggering the overflow and allowing shellcode execution.

How to fix it

Upgrade gtk-vnc to version 0.7.0 or later on all affected systems; rebuild and redistribute any dependent packages that statically link the library.

How to confirm the fix worked

Verify installed gtk-vnc package version is 0.7.0 or newer; run regression tests that exercise RRE, hextile, and copyrect decoding paths against known-good and boundary-case tiles.

Typical attack path

1. Attacker advertises or tricks user into connecting to a malicious VNC endpoint
2. Client establishes VNC session and requests screen updates
3. Server responds with RRE, hextile, or copyrect tiles containing malicious src coordinates
4. Client library performs unchecked memory copy/write leading to code execution
5. Attacker gains control of the client process

How to detect it

Review process execution logs and network connection records for VNC clients contacting unknown or newly observed servers; inspect core dumps or crash reports containing tile-decoding stack frames for signs of memory corruption.

What your security team should do

• Immediately inventory all systems using gtk-vnc and schedule upgrades to 0.7.0+
• Block or monitor outbound VNC connections to untrusted endpoints until patches are applied
• Add gtk-vnc version checks to software bill-of-materials and CI pipelines