LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4024-1 advisory.

    This update for LibVNCServer fixes the following issue:

    - CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to     write attacker-       controlled data past the end of its framebuffer (bsc#1276218).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4022-1 advisory.

    This update for LibVNCServer fixes the following issue:

    - CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to     write attacker-       controlled data past the end of its framebuffer (bsc#1276218).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3803-1 advisory.

    This update for LibVNCServer fixes the following issue:

    - CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to     write attacker-       controlled data past the end of its framebuffer (bsc#1276218).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4755 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4755-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     August 25, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libvncserver     Version        : 0.9.13+dfsg-2+deb11u2     CVE ID         : CVE-2026-32853 CVE-2026-32854 CVE-2026-44988 CVE-2026-50538     Debian Bug     : 1132016 1132017 1138174 1138253

    Several vulnerabilities were discovered in libvncserver, a     cross-platform library to implement VNC server or client functionality     in program

    CVE-2026-32853

        a heap out-of-bounds read vulnerability in the UltraZip encoding         handler that allows a malicious VNC server to cause information         disclosure or application crash. Attackers can exploit improper         bounds checking in the HandleUltraZipBPP() function by         manipulating subrectangle header counts to read beyond the         allocated heap buffer

    CVE-2026-32854

        null pointer dereference vulnerabilities in the HTTP proxy         handlers within httpProcessInput() in httpd.c that allow remote         attackers to cause a denial of service by sending specially         crafted HTTP requests. Attackers can exploit missing validation of         strchr() return values in the CONNECT and GET proxy handling paths         to trigger null pointer dereferences and crash the server when         httpd and proxy features are enabled.

    CVE-2026-44988

        LibVNCClient Tight Gradient decoding allows malicious         server-triggered heap/stack out-of-bounds writes

    CVE-2026-50538

        a malicious (or man-in-the-middle) VNC server can force a         connecting `libvncclient` to write attacker-controlled data past         the end of its framebuffer. This is an out-of-bounds heap write         with attacker-controlled length, contents, and offset.

    For Debian 11 bullseye, these problems have been fixed in version     0.9.13+dfsg-2+deb11u2.

    We recommend that you upgrade your libvncserver packages.

    For the detailed security status of libvncserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libvncserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8494-1 advisory.

    It was discovered that LibVNCServer incorrectly handled the Tight decoder in libvncclient. A remote     attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or     possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a     malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-     controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-     controlled length, contents, and offset. It needs no authentication (the attacker is the server), works in     a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim     connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting     an application callback pointer and redirecting execution to attacker-chosen code (code execution) under     the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue.
    (CVE-2026-50538)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348446	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2026:4024-1)	Nessus	SuSE Local Security Checks	Local	high
348412	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2026:4022-1)	Nessus	SuSE Local Security Checks	Local	high
341642	SUSE SLES15 Security Update : LibVNCServer (SUSE-SU-2026:3803-1)	Nessus	SuSE Local Security Checks	Local	high
339429	Debian dla-4755 : libvncclient1 - security update	Nessus	Debian Local Security Checks	Local	medium
325014	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : LibVNCServer vulnerability (USN-8494-1)	Nessus	Ubuntu Local Security Checks	Local	high
321119	Linux Distros Unpatched Vulnerability : CVE-2026-50538	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-50538

high

Tenable Plugins

high

high

high

medium

high

high