CVE-2026-32853 LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
A malicious VNC server can trigger a heap out-of-bounds read in LibVNCServer, leading to information disclosure or application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32853?
CVE-2026-32853 is a medium-severity vulnerability in LibVNCServer, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
Weakness: CWE-125
Which versions are affected by CVE-2026-32853?
It affects 1 product.
Products include Libvncserver Project Libvncserver.
How do I fix CVE-2026-32853?
Apply the vendor's patch.
Is CVE-2026-32853 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32853 exists.
Other vulnerabilities in LibVNCServer
Sources
Also known as DEBIAN-CVE-2026-32853, GHSA-87q7-v983-qwcj, UBUNTU-CVE-2026-32853.