The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3247 advisory.

    LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read     vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information     disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP()     function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
    (CVE-2026-32853)

    LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference     vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote     attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit     missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null     pointer dereferences and crash the server when httpd and proxy features are enabled. (CVE-2026-32854)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20552-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service       (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1174-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8463-1 advisory.

    It was discovered that LibVNCServer had a memory leak in the client cleanup function. An attacker could     possibly use this issue to cause LibVNCServer to consume memory, leading to a denial of service. This     issue only affected Ubuntu 22.04 LTS. (CVE-2020-29260)

    It was discovered that LibVNCServer did not properly validate bounds when handling UltraZip encoding     subrectangles. A remote attacker could possibly use this issue to obtain sensitive information or cause a     denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04.
    (CVE-2026-32853)

    It was discovered that LibVNCServer did not properly validate return values in the HTTP proxy handlers. A     remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2026-32854)

    It was discovered that LibVNCServer did not properly handle Tight encoding gradient filter rectangles. A     remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2026-44988)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1173-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21206-1 advisory.

    - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of     service       (bsc#1260431).
    - CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4755 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4755-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     August 25, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libvncserver     Version        : 0.9.13+dfsg-2+deb11u2     CVE ID         : CVE-2026-32853 CVE-2026-32854 CVE-2026-44988 CVE-2026-50538     Debian Bug     : 1132016 1132017 1138174 1138253

    Several vulnerabilities were discovered in libvncserver, a     cross-platform library to implement VNC server or client functionality     in program

    CVE-2026-32853

        a heap out-of-bounds read vulnerability in the UltraZip encoding         handler that allows a malicious VNC server to cause information         disclosure or application crash. Attackers can exploit improper         bounds checking in the HandleUltraZipBPP() function by         manipulating subrectangle header counts to read beyond the         allocated heap buffer

    CVE-2026-32854

        null pointer dereference vulnerabilities in the HTTP proxy         handlers within httpProcessInput() in httpd.c that allow remote         attackers to cause a denial of service by sending specially         crafted HTTP requests. Attackers can exploit missing validation of         strchr() return values in the CONNECT and GET proxy handling paths         to trigger null pointer dereferences and crash the server when         httpd and proxy features are enabled.

    CVE-2026-44988

        LibVNCClient Tight Gradient decoding allows malicious         server-triggered heap/stack out-of-bounds writes

    CVE-2026-50538

        a malicious (or man-in-the-middle) VNC server can force a         connecting `libvncclient` to write attacker-controlled data past         the end of its framebuffer. This is an out-of-bounds heap write         with attacker-controlled length, contents, and offset.

    For Debian 11 bullseye, these problems have been fixed in version     0.9.13+dfsg-2+deb11u2.

    We recommend that you upgrade your libvncserver packages.

    For the detailed security status of libvncserver please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libvncserver

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read     vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information     disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP()     function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
    (CVE-2026-32853)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0246 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-32853:
    LibVNCServer versions 0.9.15 and prior (fixed incommit 009008e) contain a heap out-of-bounds read     vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information     disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP()     function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
306298	Amazon Linux 2 : libvncserver, --advisory ALAS2-2026-3247 (ALAS-2026-3247)	Nessus	Amazon Linux Local Security Checks	4/14/2026	4/14/2026	medium
309147	openSUSE 16 Security Update : LibVNCServer (openSUSE-SU-2026:20552-1)	Nessus	SuSE Local Security Checks	4/22/2026	4/22/2026	medium
304853	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2026:1174-1)	Nessus	SuSE Local Security Checks	4/4/2026	4/4/2026	medium
322481	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : LibVNCServer vulnerabilities (USN-8463-1)	Nessus	Ubuntu Local Security Checks	6/24/2026	6/24/2026	medium
304854	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : LibVNCServer (SUSE-SU-2026:1173-1)	Nessus	SuSE Local Security Checks	4/4/2026	4/4/2026	medium
309159	SUSE SLES16 Security Update : LibVNCServer (SUSE-SU-2026:21206-1)	Nessus	SuSE Local Security Checks	4/22/2026	4/22/2026	medium
339429	Debian dla-4755 : libvncclient1 - security update	Nessus	Debian Local Security Checks	8/25/2026	8/25/2026	medium
303529	Linux Distros Unpatched Vulnerability : CVE-2026-32853	Nessus	Misc.	3/25/2026	8/25/2026	medium
319716	TencentOS Server 4: libvncserver (TSSA-2026:0246)	Nessus	Tencent Local Security Checks	6/8/2026	6/8/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium