LibVNCClient contains a Tight encoding decoder that allocates a 2048-pixel scratch buffer for the Gradient filter. The decoder fails to reject rectangles whose width exceeds this buffer size. A malicious VNC server can send a FramebufferUpdate rectangle using Tight encoding with NoZlib, ExplicitFilter, and the Gradient filter, causing the client to write beyond the fixed buffer. This out‑of‑bounds write can corrupt the heap or stack and potentially lead to arbitrary code execution.

The vulnerability affects LibVNCClient libraries supplied by LibVNC:libvncserver. All versions 0.9.15 and earlier are impacted. Applications that embed LibVNCClient and establish connections to untrusted VNC servers are at risk.

The CVSS score is 8.8, indicating a high severity. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by acting as a VNC server that sends a specially crafted rectangle. Victims must accept a connection from the attacker; the vulnerability is triggered during normal decoding of a server‑sent frame. The risk is high for systems that rely on unpatched LibVNCClient libraries when connecting to external VNC servers.