High severity · published Mar 24, 2026
CVE-2026-32854
LibVNCServer httpd proxy NULL Pointer Dereference
7.5
CVSS
5.4%
EPSS
No
On KEV
Description
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibVNCServer · LibVNC
through 0.9.15 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32854
Patch
https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314
Exploit
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
Third Party Advisory
https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference
More from LibVNCServer
8.8
CVE-2026-50538
libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
8.8
CVE-2026-44988
LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes
8.1
CVE-2026-32853
LibVNCServer UltraZip Encoding Heap Out-of-bounds Read