CyberRota Analysis
AI-GeneratedVersions 0.9.12 to 0.9.15 of the LibVNCClient library are vulnerable to an out-of-bounds heap write due to a malicious VNC server, allowing attackers to exploit this flaw without authentication. This vulnerability can lead to denial of service or potentially arbitrary code execution, making it critical for organizations using affected versions to prioritize immediate updates to the patched version. Users of LibVNCClient should assess their deployments and apply the necessary patches to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.