p PatchFirst

CVE-2026-44988

CVE-2026-44988 · LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.

CVSS 8.8 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libvncserver

    Versions
    • <= 0.9.15: Affected

    No fix published

  • libvncserver Debian:12

    Versions
    • 0.9.14+dfsg-1
    • 0.9.14+dfsg-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 0.9.14+dfsg-1+deb12u2

    Update to 0.9.14+dfsg-1+deb12u2

  • libvncserver Debian:13

    Versions
    • 0.9.15+dfsg-1
    • 0.9.15+dfsg-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 0.9.15+dfsg-1+deb13u2

    Update to 0.9.15+dfsg-1+deb13u2

  • libvncserver Debian:14

    Versions
    • 0.9.15+dfsg-1
    • 0.9.15+dfsg-2
    • 0.9.15+dfsg-3
    • 0.9.15+dfsg-4
    Affected ranges
    • ECOSYSTEM: < 0.9.15+dfsg-5

    Update to 0.9.15+dfsg-5

  • tightvnc Ubuntu:Pro:14.04:LTS

    Versions
    • 1.3.9-6.4
    • 1.3.9-6.4ubuntu1
    • 1.3.9-6.5+deb8u1build0.14.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:14.04:LTS

    Versions
    • 0.9.13-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:16.04:LTS

    Versions
    • 0.9.10+dfsg-3
    • 0.9.10+dfsg-3build1
    • 0.9.10+dfsg-3ubuntu0.16.04.1
    • 0.9.10+dfsg-3ubuntu0.16.04.2
    • 0.9.10+dfsg-3ubuntu0.16.04.3
    • 0.9.10+dfsg-3ubuntu0.16.04.4
    • 0.9.10+dfsg-3ubuntu0.16.04.5
    • 0.9.10+dfsg-3ubuntu0.16.04.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:16.04:LTS

    Versions
    • 3.8.1-0ubuntu6
    • 3.8.1-0ubuntu7
    • 3.8.1-0ubuntu8
    • 3.8.1-0ubuntu9
    • 3.8.1-0ubuntu9.1
    • 3.8.1-0ubuntu9.2
    • 3.8.1-0ubuntu9.3
    • 3.8.1-0ubuntu9.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • italc Ubuntu:16.04:LTS

    Versions
    • 1:2.0.2+dfsg1-3
    • 1:2.0.2+dfsg1-4
    • 1:2.0.2+dfsg1-4ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:16.04:LTS

    Versions
    • 1.3.10-0ubuntu2
    • 1.3.10-0ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:16.04:LTS

    Versions
    • 0.9.13-1.2build1
    • 0.9.13-1.2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:18.04:LTS

    Versions
    • 0.9.11+dfsg-1
    • 0.9.11+dfsg-1ubuntu1
    • 0.9.11+dfsg-1ubuntu1.1
    • 0.9.11+dfsg-1ubuntu1.2
    • 0.9.11+dfsg-1ubuntu1.3
    • 0.9.11+dfsg-1ubuntu1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:18.04:LTS

    Versions
    • 3.8.1-0ubuntu12
    • 3.22.0-2ubuntu1
    • 3.22.0-3ubuntu1
    • 3.22.0-3ubuntu1.1
    • 3.22.0-3ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • italc Ubuntu:18.04:LTS

    Versions
    • 1:3.0.3+dfsg1-1
    • 1:3.0.3+dfsg1-2
    • 1:3.0.3+dfsg1-2build1
    • 1:3.0.3+dfsg1-2ubuntu1
    • 1:3.0.3+dfsg1-3
    • 1:3.0.3+dfsg1-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:18.04:LTS

    Versions
    • 1.3.10-0ubuntu3
    • 1.3.10-0ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:18.04:LTS

    Versions
    • 0.9.13-2
    • 0.9.13-2build1
    • 0.9.13-3
    • 0.9.13-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:20.04:LTS

    Versions
    • 0.9.11+dfsg-1.3
    • 0.9.12+dfsg-3ubuntu3
    • 0.9.12+dfsg-6
    • 0.9.12+dfsg-7
    • 0.9.12+dfsg-8
    • 0.9.12+dfsg-9
    • 0.9.12+dfsg-9ubuntu0.1
    • 0.9.12+dfsg-9ubuntu0.2
    • 0.9.12+dfsg-9ubuntu0.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vino Ubuntu:20.04:LTS

    Versions
    • 3.22.0-5ubuntu2
    • 3.22.0-5ubuntu2.1
    • 3.22.0-5ubuntu2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tightvnc Ubuntu:20.04:LTS

    Versions
    • 1.3.10-0ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • veyon Ubuntu:20.04:LTS

    Versions
    • 4.2.4+repack1-2
    • 4.2.5+repack1-1
    • 4.3.1+repack1-1
    • 4.3.1+repack1-2
    • 4.3.1+repack1-2build1
    • 4.3.1+repack1-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • x11vnc Ubuntu:Pro:20.04:LTS

    Versions
    • 0.9.13-6
    • 0.9.16-3
    • 0.9.16-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvncserver Ubuntu:22.04:LTS

    Versions
    • 0.9.13+dfsg-3
    • 0.9.13+dfsg-3build1
    • 0.9.13+dfsg-3build2
    Affected ranges
    • ECOSYSTEM: < 0.9.13+dfsg-3ubuntu0.1

    Update to 0.9.13+dfsg-3ubuntu0.1

  • tightvnc Ubuntu:22.04:LTS

    Versions
    • 1:1.3.10-3
    • 1:1.3.10-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • veyon Ubuntu:22.04:LTS

    Versions
    • 4.5.3+repack1-1build1
    • 4.5.3+repack1-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →