---
id: CVE-2026-32853
title: LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
summary: "LibVNCServer versions 0.9.15 and prior (fixed in\_commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. At…"
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: LibVNC
product: LibVNCServer
affected:
  - LibVNCServer <= 0.9.15
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-25T13:41:12.751342Z'
exploitAvailable: true
published: '2026-03-24'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:00.136Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-32853'
references:
  - url: >-
      https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
    label: GitHub Security Advisory (GHSA-87q7-v983-qwcj)
  - url: >-
      https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931
  - url: >-
      https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read
tags:
  - cve.org
  - exploit-available
epss: 0.00445
epssPercentile: 0.38946
ingestedAt: '2026-11-08T14:51:22.456Z'
---

## Overview

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

## Affected

- `LibVNCServer <= 0.9.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.