Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50538— libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write

Quick assessment

Affected
LibVNC libvncserver
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibVNCClient 是一个用于简化 VNC 客户端实现的库。在 0.9.12 至 0.9.15 版本中，恶意的（或处于中间人位置的）VNC 服务器可以迫使连接的 向其帧缓冲区（framebuffer）末尾之外写入由攻击者控制的数据。这是一种越界堆写入漏洞，攻击者可完全控制写入的长度、内容和偏移量。该漏洞无需身份验证（因为攻击者即为服务器端），在默认构建且使用默认配置的情况下即可生效，并且只需一个 消息，在受害者连接建立的瞬间即可触发。此漏洞会导致所有客户端无条件崩溃（拒绝服务）；此外，我们在默认配置下还演示了

CVSS 8.8 · High EPSS 0.32% · P25

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
LibVNC libvncserver >= 0.9.12, <= 0.9.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50538

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
Source: CVE Program / CVE List V5
Vulnerability Description
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LibVNC libvncserver >= 0.9.12, <= 0.9.15 -

II. Public POCs for CVE-2026-50538

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 12282 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-50538

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-50538 (1)

Vendor Advisories for CVE-2026-50538 (1)

IV. Related Vulnerabilities

Same product: libvncserver
Same vendor: LibVNC
Same weakness: CWE-122

V. Comments for CVE-2026-50538

No comments yet

Leave a comment