A stack buffer overflow occurs in Neat VNC's RSA‑AES security type handler when an unauthenticated remote client sends an oversized RSA public key during the handshake. The overflow corrupts a 1024‑byte on‑stack buffer while encrypting the server challenge, causing the server to crash. The description indicates at least a denial of service, and because the overflow takes place before any authentication, a malicious actor could potentially elevate the vulnerability to arbitrary code execution, although this is not explicitly confirmed in the announcement.

The Neat VNC library, produced by any1, is affected for all releases prior to version 0.9.6. The issue exists in the RSA-AES and RSA-AES‑256 protocols; any installation deploying these security types before the 0.9.6 update is vulnerable.

This flaw carries a CVSS score of 8.1, and it is currently not listed in the CISA KEV catalog. The EPSS score is unavailable, but the lack of a required authentication makes it highly actionable. An attacker who can reach the VNC listening socket can simply craft a malicious handshake message containing an oversized key, trigger the overflow, and crash the server, which is a straightforward exploit path with no privilege escalation needed on the client side.