CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
A malicious VNC server can trigger a heap out-of-bounds write in libvncclient, leading to remote code execution or denial of service upon connection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50538?
CVE-2026-50538 is a high-severity memory corruption vulnerability in libvncserver, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.
Which versions are affected by CVE-2026-50538?
Linux distribution packages (9)
LibVNCServer SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 0.9.10-150000.4.41.1 |
LibVNCServer SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 0.9.14-150600.3.12.1 |
LibVNCServer SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.9.9-17.50.1 |
LibVNCServer SUSE:Linux Enterprise Server 16.0 | All versions | 0.9.14-160000.6.1 |
LibVNCServer SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.9.9-17.50.1 |
LibVNCServer SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.9.14-160000.6.1 |
LibVNCServer SUSE:Linux Enterprise Workstation Extension 15 SP7 | All versions | 0.9.14-150600.3.12.1 |
LibVNCServer openSUSE:Leap 16.0 | All versions | 0.9.14-160000.6.1 |
LibVNCServer openSUSE:Tumbleweed | All versions | 0.9.15-4.1 |
How do I fix CVE-2026-50538?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-50538 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50538 exists.
Sources
Also known as DEBIAN-CVE-2026-50538, GHSA-v9pm-47h4-jcq8, OESA-2026-3318, OESA-2026-3319, OESA-2026-3320, OESA-2026-3489 and 8 more.