CVE-2026-50538

libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to "export" a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself.

Security Fix(es):

An attacker-controlled heap out-of-bounds write vulnerability exists in the Tight decoder of libvncclient within libvncserver. An attacker can trigger a heap out-of-bounds write via crafted packets, potentially leading to denial of service or remote code execution.(CVE-2026-50538)

libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to "export" a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself.

Security Fix(es):

An attacker-controlled heap out-of-bounds write vulnerability exists in the Tight decoder of libvncclient within libvncserver. An attacker can trigger a heap out-of-bounds write via crafted packets, potentially leading to denial of service or remote code execution.(CVE-2026-50538)

libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to "export" a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself.

Security Fix(es):

An attacker-controlled heap out-of-bounds write vulnerability exists in the Tight decoder of libvncclient within libvncserver. An attacker can trigger a heap out-of-bounds write via crafted packets, potentially leading to denial of service or remote code execution.(CVE-2026-50538)

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single FramebufferUpdate the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.

The updated packages fix security vulnerabilities: Heap Out-of-Bounds Read in HandleUltraZipBPP due to unchecked subrectangle count. (CVE-2026-32853) NULL pointer dereferences in httpd proxy handlers via malformed CONNECT/GET requests. (CVE-2026-32854) LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes. (CVE-2026-44988) Attacker-controlled heap out-of-bounds write in libvncclient Tight decoder. (CVE-2026-50538)

These are all security issues fixed in the LibVNCServer-devel-0.9.15-4.1 package on the GA media of openSUSE Tumbleweed.

This update for LibVNCServer fixes the following issue:

• CVE-2026-50538: malicious or MiTM VNC servers can force a connecting libvncclient to write attacker-controlled data past the end of a framebuffer, which can lead to a crash or arbitrary code execution (bsc#1276218).

This update for LibVNCServer fixes the following issue:

• CVE-2026-50538: malicious or MiTM VNC servers can force a connecting libvncclient to write attacker-controlled data past the end of a framebuffer, which can lead to a crash or arbitrary code execution (bsc#1276218).

This update for LibVNCServer fixes the following issue:

• CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker- controlled data past the end of its framebuffer (bsc#1276218).

This update for LibVNCServer fixes the following issue:

• CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker- controlled data past the end of its framebuffer (bsc#1276218).

This update for LibVNCServer fixes the following issue:

• CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting libvncclient to write attacker- controlled data past the end of its framebuffer (bsc#1276218).

It was discovered that LibVNCServer incorrectly handled the Tight decoder in libvncclient. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code.