High severity · published Mar 24, 2026
CVE-2026-32853
LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibVNCServer · LibVNC
through 0.9.15 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32853
Patch
https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931
Vendor Advisory
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
Exploit
https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read
More from LibVNCServer
8.8
CVE-2026-50538
libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
8.8
CVE-2026-44988
LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes
7.5
CVE-2026-32854
LibVNCServer httpd proxy NULL Pointer Dereference