p PatchFirst

CVE-2026-32854

CVE-2026-32854 · LibVNCServer httpd proxy NULL Pointer Dereference

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

CVSS 6.3 · Medium · EPSS 5.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libvncserver

    Versions
    • ≥ 0, ≤ 0.9.15: Affected (semver)
    • dc78dee51a7e270e537a541a17befdf2073f5314: Not affected (git)

    No fix published

  • libvncserver Debian:12

    Versions
    • 0.9.14+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 0.9.14+dfsg-1+deb12u1

    Update to 0.9.14+dfsg-1+deb12u1

  • libvncserver Debian:13

    Versions
    • 0.9.15+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 0.9.15+dfsg-1+deb13u1

    Update to 0.9.15+dfsg-1+deb13u1

  • libvncserver Debian:14

    Versions
    • 0.9.15+dfsg-1
    • 0.9.15+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 0.9.15+dfsg-3

    Update to 0.9.15+dfsg-3

  • tightvnc Ubuntu:Pro:14.04:LTS

    Versions
    • 1.3.9-6.4
    • 1.3.9-6.4ubuntu1
    • 1.3.9-6.5+deb8u1build0.14.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:14.04:LTS

    Versions
    • 0.9.13-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:16.04:LTS

    Versions
    • 0.9.10+dfsg-3
    • 0.9.10+dfsg-3build1
    • 0.9.10+dfsg-3ubuntu0.16.04.1
    • 0.9.10+dfsg-3ubuntu0.16.04.2
    • 0.9.10+dfsg-3ubuntu0.16.04.3
    • 0.9.10+dfsg-3ubuntu0.16.04.4
    • 0.9.10+dfsg-3ubuntu0.16.04.5
    • 0.9.10+dfsg-3ubuntu0.16.04.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:16.04:LTS

    Versions
    • 3.8.1-0ubuntu6
    • 3.8.1-0ubuntu7
    • 3.8.1-0ubuntu8
    • 3.8.1-0ubuntu9
    • 3.8.1-0ubuntu9.1
    • 3.8.1-0ubuntu9.2
    • 3.8.1-0ubuntu9.3
    • 3.8.1-0ubuntu9.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • italc Ubuntu:16.04:LTS

    Versions
    • 1:2.0.2+dfsg1-3
    • 1:2.0.2+dfsg1-4
    • 1:2.0.2+dfsg1-4ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:16.04:LTS

    Versions
    • 1.3.10-0ubuntu2
    • 1.3.10-0ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:16.04:LTS

    Versions
    • 0.9.13-1.2build1
    • 0.9.13-1.2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:18.04:LTS

    Versions
    • 0.9.11+dfsg-1
    • 0.9.11+dfsg-1ubuntu1
    • 0.9.11+dfsg-1ubuntu1.1
    • 0.9.11+dfsg-1ubuntu1.2
    • 0.9.11+dfsg-1ubuntu1.3
    • 0.9.11+dfsg-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:18.04:LTS

    Versions
    • 3.8.1-0ubuntu12
    • 3.22.0-2ubuntu1
    • 3.22.0-3ubuntu1
    • 3.22.0-3ubuntu1.1
    • 3.22.0-3ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • italc Ubuntu:18.04:LTS

    Versions
    • 1:3.0.3+dfsg1-1
    • 1:3.0.3+dfsg1-2
    • 1:3.0.3+dfsg1-2build1
    • 1:3.0.3+dfsg1-2ubuntu1
    • 1:3.0.3+dfsg1-3
    • 1:3.0.3+dfsg1-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:18.04:LTS

    Versions
    • 1.3.10-0ubuntu3
    • 1.3.10-0ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:18.04:LTS

    Versions
    • 0.9.13-2
    • 0.9.13-2build1
    • 0.9.13-3
    • 0.9.13-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:20.04:LTS

    Versions
    • 0.9.11+dfsg-1.3
    • 0.9.12+dfsg-3ubuntu3
    • 0.9.12+dfsg-6
    • 0.9.12+dfsg-7
    • 0.9.12+dfsg-8
    • 0.9.12+dfsg-9
    • 0.9.12+dfsg-9ubuntu0.1
    • 0.9.12+dfsg-9ubuntu0.2
    • 0.9.12+dfsg-9ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:20.04:LTS

    Versions
    • 3.22.0-5ubuntu2
    • 3.22.0-5ubuntu2.1
    • 3.22.0-5ubuntu2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:20.04:LTS

    Versions
    • 1.3.10-0ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • veyon Ubuntu:20.04:LTS

    Versions
    • 4.2.4+repack1-2
    • 4.2.5+repack1-1
    • 4.3.1+repack1-1
    • 4.3.1+repack1-2
    • 4.3.1+repack1-2build1
    • 4.3.1+repack1-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:20.04:LTS

    Versions
    • 0.9.13-6
    • 0.9.16-3
    • 0.9.16-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:22.04:LTS

    Versions
    • 0.9.13+dfsg-3
    • 0.9.13+dfsg-3build1
    • 0.9.13+dfsg-3build2
    Affected ranges
    • ECOSYSTEM: < 0.9.13+dfsg-3ubuntu0.1

    Update to 0.9.13+dfsg-3ubuntu0.1

  • tightvnc Ubuntu:22.04:LTS

    Versions
    • 1:1.3.10-3
    • 1:1.3.10-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • veyon Ubuntu:22.04:LTS

    Versions
    • 4.5.3+repack1-1build1
    • 4.5.3+repack1-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →