A malicious VNC server can trigger an out‑of‑bounds heap write in libvncclient by sending a FramebufferUpdate message that contains data larger than the current framebuffer. The attacker controls the length, contents, and offset of the data, allowing the client to write beyond the end of the heap buffer. This memory corruption can unconditionally crash the client, creating a denial of service, and the developers demonstrated that it could overwrite a callback pointer, leading to arbitrary code execution when the default configuration is used. The vulnerability is present in libvncclient versions 0.9.12 through 0.9.15 and requires no authentication on the VNC side, meaning any server can exploit it immediately after a client connects.

Vulnerable releases are libvncclient part of the libvncserver project, specifically versions 0.9.12 to 0.9.15. The issue affects all builds that use the default Tight decoder and default settings, so any system deploying libvncclient from these releases is at risk.

The CVSS score of 8.8 denotes high severity. Although EPSS data is unavailable, the lack of authentication on the server side and the fact that the exploit is triggered with a single FramebufferUpdate make it highly usable in real‑world scenarios, especially for attackers who can impersonate a VNC server. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. To mitigate the risk, the immediate upgrade to the patched version is essential.