---
id: CVE-2026-32854
title: LibVNCServer httpd proxy NULL Pointer Dereference
summary: "LibVNCServer versions 0.9.15 and prior (fixed in\_commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by…"
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-476
vendor: LibVNC
product: LibVNCServer
affected:
  - LibVNCServer <= 0.9.15
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-27T03:52:09.338985Z'
exploitAvailable: true
published: '2026-03-24'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:00.977Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-32854'
references:
  - url: >-
      https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
    label: GitHub Security Advisory (GHSA-xjp8-4qqv-5x4x)
  - url: >-
      https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314
  - url: >-
      https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference
tags:
  - cve.org
  - exploit-available
epss: 0.05415
epssPercentile: 0.92753
ingestedAt: '2026-11-08T14:51:22.456Z'
---

## Overview

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

## Affected

- `LibVNCServer <= 0.9.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.