The flaw lies in the Qt VNC Server’s password authentication logic, allowing an attacker who crafts a VNC client that breaks the RFB protocol to bypass authentication and connect to the server. If successful, the attacker can see, interact with, and potentially modify the shared application, breaching confidentiality and integrity.

Qt solutions that embed the Qt VNC Server module are affected; the vendor lists only the general Qt product, with no specific component or version details disclosed.

The CVSS base score of 4.5 indicates moderate severity. The EPSS score of 0.00342 suggests a very low probability of exploitation in realistic environments, yet the vulnerability is still actionable because an attacker only needs a VNC client capable of deviating from standard protocol. The vulnerability is not listed in the CISA KEV catalog, meaning there is no current evidence of widespread exploitation, but the risk remains if the Qt VNC Server module is exposed to the network. The workaround requires disabling or patching the VNC Server; otherwise risk of unauthorized remote session remains.