This vulnerability occurs when a VNC client processes an UltraZip encoded frame that contains a manipulated subrectangle header count. The HandleUltraZipBPP() function fails to enforce proper bounds on the heap buffer, allowing a remote VNC server to read memory beyond the allocated region. The resulting out‑of‑bounds read can expose sensitive data stored in RAM or cause the client application to crash, resulting in a denial of service.

The issue affects LibVNCServer releases 0.9.15 and older. Any system that runs these versions of the library while accepting remote connections using the UltraZip encoding is potentially vulnerable. Updating to a version that includes the fix introduced in commit 009008e is required to remove the flaw.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation history. Attackers would need to control a VNC server that communicates with the vulnerable client; the attack vector is remote and network‑based. If the attacker can induce the vulnerable client to decode crafted UltraZip data, the out‑of‑bounds read occurs during normal operation without special privileges on the client machine.