LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

suse_linux SUSE-SU-2026:1124-1: SUSE SLES15 : Security update for LibVNCServer (Important) (SUSE-SU-2026:1124-1)

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21206-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service       (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20552-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service       (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3247 advisory.

    LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read     vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information     disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP()     function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
    (CVE-2026-32853)

    LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference     vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote     attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit     missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null     pointer dereferences and crash the server when httpd and proxy features are enabled. (CVE-2026-32854)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1173-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1174-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read     vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information     disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP()     function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
    (CVE-2026-32853)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
309159	SUSE SLES16 Security Update : LibVNCServer (SUSE-SU-2026:21206-1)	Nessus	SuSE Local Security Checks	medium
309147	openSUSE 16 Security Update : LibVNCServer (openSUSE-SU-2026:20552-1)	Nessus	SuSE Local Security Checks	medium
306298	Amazon Linux 2 : libvncserver, --advisory ALAS2-2026-3247 (ALAS-2026-3247)	Nessus	Amazon Linux Local Security Checks	medium
304854	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : LibVNCServer (SUSE-SU-2026:1173-1)	Nessus	SuSE Local Security Checks	medium
304853	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2026:1174-1)	Nessus	SuSE Local Security Checks	medium
303529	Linux Distros Unpatched Vulnerability : CVE-2026-32853	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32853

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium