CVE catalog

CVE-2026-32853

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Published: Mar 24, 2026, 5:30:40 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.45% · Oct 25, 2026

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libvncserver	sid	`0.9.15+dfsg-6`	fixed
Debian	libvncserver	forky	`0.9.15+dfsg-6`	fixed
Debian	libvncserver	trixie	`0.9.15+dfsg-1+deb13u2`	fixed
Debian	libvncserver	bookworm	`0.9.14+dfsg-1+deb12u2`	fixed
Cpe	libvncserver	Not reported	`0.9.14+dfsg-1ubuntu0.1`	fixed
Cpe	libvncclient1	Not reported	`0.9.14+dfsg-1ubuntu0.1`	fixed
Cpe	libvncserver-dev	Not reported	`0.9.14+dfsg-1ubuntu0.1`	fixed
Cpe	libvncserver1	Not reported	`0.9.14+dfsg-1ubuntu0.1`	fixed
Cpe	libvncserver	Not reported	`0.9.14+dfsg-1+deb12u1`	fixed
Opensuse	LibVNCServer	leap 16.0	`0.9.14-160000.4.1`	fixed
Suse	LibVNCServer	linux enterprise server 16.0	`0.9.14-160000.4.1`	fixed
Suse	LibVNCServer	linux enterprise server for sap applications 16.0	`0.9.14-160000.4.1`	fixed
Suse	LibVNCServer	linux enterprise server 12 sp5-ltss	`0.9.9-17.44.1`	fixed
Suse	LibVNCServer	linux enterprise server ltss extended security 12 sp5	`0.9.9-17.44.1`	fixed
Suse	LibVNCServer	linux enterprise module for package hub 15 sp7	`0.9.14-150600.3.6.1`	fixed
Suse	LibVNCServer	linux enterprise workstation extension 15 sp7	`0.9.14-150600.3.6.1`	fixed
Opensuse	LibVNCServer	leap 15.6	`0.9.14-150600.3.6.1`	fixed
Suse	LibVNCServer	linux enterprise module for package hub 15 sp7	`0.9.10-150000.4.35.1`	fixed
Opensuse	LibVNCServer	tumbleweed	`0.9.15-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libvncserver	source	sid	`0.9.15+dfsg-3`	not yet assigned	Not reported	[1132016]
Debian	libvncserver	source	forky	`0.9.15+dfsg-3`	not yet assigned	Not reported	[1132016]
Debian	libvncserver	source	trixie	`0.9.15+dfsg-1+deb13u1`	not yet assigned	Not reported	[1132016]
Debian	libvncserver	source	bookworm	`0.9.14+dfsg-1+deb12u1`	not yet assigned	Not reported	[1132016]
Cpe	libvncserver	cpe	Not reported	`0.9.14+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libvncclient1	cpe	Not reported	`0.9.14+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libvncserver-dev	cpe	Not reported	`0.9.14+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libvncserver1	cpe	Not reported	`0.9.14+dfsg-1ubuntu0.1`	Not reported	Not reported	Not reported
Cpe	libvncserver	cpe	Not reported	`0.9.14+dfsg-1+deb12u1`	Not reported	Not reported	Not reported
Opensuse	LibVNCServer	rpm	leap 16.0	`0.9.14-160000.4.1`	Not reported	OPENSUSE-SU-2026:20552-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise server 16.0	`0.9.14-160000.4.1`	Not reported	SUSE-SU-2026:21206-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise server for sap applications 16.0	`0.9.14-160000.4.1`	Not reported	SUSE-SU-2026:21206-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise server 12 sp5-ltss	`0.9.9-17.44.1`	Not reported	SUSE-SU-2026:1174-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise server ltss extended security 12 sp5	`0.9.9-17.44.1`	Not reported	SUSE-SU-2026:1174-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise module for package hub 15 sp7	`0.9.14-150600.3.6.1`	Not reported	SUSE-SU-2026:1173-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise workstation extension 15 sp7	`0.9.14-150600.3.6.1`	Not reported	SUSE-SU-2026:1173-1	Not reported
Opensuse	LibVNCServer	rpm	leap 15.6	`0.9.14-150600.3.6.1`	Not reported	SUSE-SU-2026:1173-1	Not reported
Suse	LibVNCServer	rpm	linux enterprise module for package hub 15 sp7	`0.9.10-150000.4.35.1`	Not reported	SUSE-SU-2026:1124-1	Not reported
Opensuse	LibVNCServer	rpm	tumbleweed	`0.9.15-2.1`	Not reported	OPENSUSE-SU-2026:10433-1	Not reported

[Debian bug #1132016]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libvncclient1]Unknown
Source package: [LibVNCServer]
Details (1)
- 0.9.15-4.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.9.15-2.1
  Version impact unknown
  nvd · LibVNCServer · opensuse · tumbleweed
[libvncserver1]Unknown
Source package: [LibVNCServer]
Details (1)
- 0.9.15-4.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.9.15-2.1
  Version impact unknown
  nvd · LibVNCServer · opensuse · tumbleweed
[LibVNCServer-devel]Unknown
Source package: [LibVNCServer]
Details (1)
- 0.9.15-4.1 · x86_64 · tumbleweed
  Unknown · Fixed: 0.9.15-2.1
  Version impact unknown
  nvd · LibVNCServer · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libvncclient1]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.14+dfsg-1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
- 0.9.14+dfsg-1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
[libvncserver1]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.14+dfsg-1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
- 0.9.14+dfsg-1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
[libvncserver-dev]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.14+dfsg-1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
- 0.9.14+dfsg-1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.9.14+dfsg-1+deb12u1
  nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12

[Debian 13 (Trixie)]

[libvncclient1]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.15+dfsg-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13
- 0.9.15+dfsg-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13
[libvncserver1]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.15+dfsg-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13
- 0.9.15+dfsg-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13
[libvncserver-dev]Fixed
Source package: [libvncserver]
Details (2)
- 0.9.15+dfsg-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13
- 0.9.15+dfsg-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 0.9.15+dfsg-1+deb13u1
  nvd · libvncserver · debian · 13

Observed: Oct 23, 2026, 10:39:03 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]