← Vulnerability feed

Vulnerability record · CVE-2026-32854 · published 24 March 2026

CVE-2026-32854: Libvncserver project libvncserver null pointer dereference vulnerability

LLibvncserver Project · Libvncserver

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

6.3 CVSS 4.0 Medium EPSS 5.3% · top 7.7% CWE-476 · NULL pointer dereference
6.3CVSS 4.0 base score
5.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
14 Jul 2026Last modified by NVD

Description

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 Patch
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x ExploitVendor Advisory
https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference Third Party Advisory

Track CVE-2026-32854 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-18922Libvncserver project libvncserver out-of-bounds write vulnerabilityIt was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could expl…EPSS 2.3%9.8CVE-2018-7225Libvncserver project libvncserver integer overflow vulnerabilityAn issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to a…EPSS 6.1%9.8CVE-2016-9941Libvncserver project libvncserver memory buffer overflow vulnerabilityHeap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (applicatio…EPSS 3.7%9.8CVE-2016-9942Libvncserver project libvncserver memory buffer overflow vulnerabilityHeap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application c…EPSS 3.7%7.5CVE-2020-29260Libvncserver project libvncserver uncontrolled resource consumption vulnerabilitylibvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().EPSS 1.1%7.5CVE-2020-25708Libvncserver project libvncserver divide by zero vulnerabilityA divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, wh…EPSS 1.6%7.5CVE-2020-14399Libvncserver project libvncserver vulnerabilityAn issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: ther…EPSS 2.8%7.5CVE-2020-14400Libvncserver project libvncserver vulnerabilityAn issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Thi…EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2026-32854), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.