CVE-2026-44988
High · 8.8CVSS
8.8
EPSS
0.4%
Published
May 27, 2026
CISA due date
—
The record
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | LibVNCServer | 0 | 0.9.14-160000.5.1 |
| openSUSE:Tumbleweed | LibVNCServer | 0 | 0.9.15-3.1 |
Related vulnerabilities
- CVE-2026-32853 LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap… Also affects LibVNCServer
- CVE-2026-32854 LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer… Also affects LibVNCServer
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
- CVE-2026-112397 Pillow is a Python imaging library. CWE-787
- CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
- CVE-2026-89088 A flaw was found in parted. CWE-787
- CVE-2026-89085 A flaw was found in parted. CWE-787
- CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. CWE-787