CVE-2026-32854
High · 7.5CVSS
7.5
EPSS
5.4%
Published
Mar 24, 2026
CISA due date
—
The record
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | LibVNCServer | 0 | 0.9.14-150600.3.6.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | LibVNCServer | 0 | 0.9.14-150600.3.6.1 |
| openSUSE:Leap 15.6 | LibVNCServer | 0 | 0.9.14-150600.3.6.1 |
| openSUSE:Leap 16.0 | LibVNCServer | 0 | 0.9.14-160000.4.1 |
| openSUSE:Tumbleweed | LibVNCServer | 0 | 0.9.15-2.1 |
Related vulnerabilities
- CVE-2026-32853 LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap… Also affects LibVNCServer
- CVE-2026-44988 LibVNCClient is a library for easy implementation of a VNC client. Also affects LibVNCServer
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476
- CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the… CWE-476