CVE-2026-50538

Received Received - Intake

Heap Write in LibVNCClient

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-50538

Affected Vendors & Products

Vendor	Product	Version / Range
libvncserver	libvncclient	From 0.9.12 (inc) to 0.9.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds heap write in LibVNCClient versions 0.9.12 through 0.9.15. A malicious VNC server can force a connecting client to write attacker-controlled data past the end of its framebuffer. It allows arbitrary memory corruption with attacker-controlled length, contents, and offset. The attack requires no authentication, works in default builds, and triggers immediately upon connection.

Detection Guidance

Detection requires monitoring for abnormal VNC server behavior or crashes in libvncclient versions 0.9.12 through 0.9.15. Check running VNC clients for unexpected crashes or memory corruption. Inspect network traffic for VNC FramebufferUpdate messages from untrusted servers.

Impact Analysis

This vulnerability can crash any client unconditionally, causing a denial of service. It can also overwrite application callback pointers and redirect execution to attacker-chosen code, leading to arbitrary code execution. Since the attacker is the server, no authentication is needed to exploit it.

Mitigation Strategies

Upgrade libvncclient to version 0.9.16 or later using your package manager. If upgrading is not possible, avoid connecting to untrusted VNC servers. Monitor for crashes in VNC clients as potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-50538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70