CVE-2026-32854 LibVNCServer httpd proxy NULL Pointer Dereference
Remote attackers can crash the LibVNCServer by sending crafted HTTP requests when proxy features are enabled, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32854?
CVE-2026-32854 is a medium-severity vulnerability in LibVNCServer, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
Weakness: CWE-476
Which versions are affected by CVE-2026-32854?
It affects 1 product.
Products include Libvncserver Project Libvncserver.
How do I fix CVE-2026-32854?
Apply the vendor's patch.
Is CVE-2026-32854 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32854 exists.
Other vulnerabilities in LibVNCServer
Sources
Also known as DEBIAN-CVE-2026-32854, GHSA-xjp8-4qqv-5x4x, UBUNTU-CVE-2026-32854.