CVE catalog
CVE-2026-44988
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.24% · Oct 25, 2026
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libvncserver | sid | 0.9.15+dfsg-6 | fixed |
| Debian | libvncserver | forky | 0.9.15+dfsg-6 | fixed |
| Debian | libvncserver | trixie | 0.9.15+dfsg-1+deb13u2 | fixed |
| Debian | libvncserver | bookworm | 0.9.14+dfsg-1+deb12u2 | fixed |
| Cpe | libvncserver | Not reported | 0.9.14+dfsg-1ubuntu0.1 | fixed |
| Cpe | libvncclient1 | Not reported | 0.9.14+dfsg-1ubuntu0.1 | fixed |
| Cpe | libvncserver-dev | Not reported | 0.9.14+dfsg-1ubuntu0.1 | fixed |
| Cpe | libvncserver1 | Not reported | 0.9.14+dfsg-1ubuntu0.1 | fixed |
| Cpe | libvncserver | Not reported | 0.9.14+dfsg-1+deb12u2 | fixed |
| Opensuse | LibVNCServer | leap 16.0 | 0.9.14-160000.5.1 | fixed |
| Suse | LibVNCServer | linux enterprise server 16.0 | 0.9.14-160000.5.1 | fixed |
| Suse | LibVNCServer | linux enterprise server for sap applications 16.0 | 0.9.14-160000.5.1 | fixed |
| Suse | LibVNCServer | linux enterprise module for package hub 15 sp7 | 0.9.14-150600.3.9.1 | fixed |
| Suse | LibVNCServer | linux enterprise workstation extension 15 sp7 | 0.9.14-150600.3.9.1 | fixed |
| Suse | LibVNCServer | linux enterprise server 12 sp5-ltss | 0.9.9-17.47.1 | fixed |
| Suse | LibVNCServer | linux enterprise server ltss extended security 12 sp5 | 0.9.9-17.47.1 | fixed |
| Opensuse | LibVNCServer | tumbleweed | 0.9.15-3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libvncserver | source | sid | 0.9.15+dfsg-5 | not yet assigned | Not reported | [1138174] |
| Debian | libvncserver | source | forky | 0.9.15+dfsg-5 | not yet assigned | Not reported | [1138174] |
| Debian | libvncserver | source | trixie | 0.9.15+dfsg-1+deb13u2 | not yet assigned | Not reported | [1138174] |
| Debian | libvncserver | source | bookworm | 0.9.14+dfsg-1+deb12u2 | not yet assigned | Not reported | [1138174] |
| Cpe | libvncserver | cpe | Not reported | 0.9.14+dfsg-1ubuntu0.1 | Not reported | Not reported | Not reported |
| Cpe | libvncclient1 | cpe | Not reported | 0.9.14+dfsg-1ubuntu0.1 | Not reported | Not reported | Not reported |
| Cpe | libvncserver-dev | cpe | Not reported | 0.9.14+dfsg-1ubuntu0.1 | Not reported | Not reported | Not reported |
| Cpe | libvncserver1 | cpe | Not reported | 0.9.14+dfsg-1ubuntu0.1 | Not reported | Not reported | Not reported |
| Cpe | libvncserver | cpe | Not reported | 0.9.14+dfsg-1+deb12u2 | Not reported | Not reported | Not reported |
| Opensuse | LibVNCServer | rpm | leap 16.0 | 0.9.14-160000.5.1 | Not reported | OPENSUSE-SU-2026:21118-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise server 16.0 | 0.9.14-160000.5.1 | Not reported | SUSE-SU-2026:22190-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise server for sap applications 16.0 | 0.9.14-160000.5.1 | Not reported | SUSE-SU-2026:22190-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise module for package hub 15 sp7 | 0.9.14-150600.3.9.1 | Not reported | SUSE-SU-2026:2427-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise workstation extension 15 sp7 | 0.9.14-150600.3.9.1 | Not reported | SUSE-SU-2026:2427-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise server 12 sp5-ltss | 0.9.9-17.47.1 | Not reported | SUSE-SU-2026:2428-1 | Not reported |
| Suse | LibVNCServer | rpm | linux enterprise server ltss extended security 12 sp5 | 0.9.9-17.47.1 | Not reported | SUSE-SU-2026:2428-1 | Not reported |
| Opensuse | LibVNCServer | rpm | tumbleweed | 0.9.15-3.1 | Not reported | OPENSUSE-SU-2026:10905-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [libvncclient1]Unknown
Source package: [LibVNCServer]
Details (1)
0.9.15-4.1· x86_64 · tumbleweedUnknown · Fixed:
0.9.15-3.1Version impact unknown
nvd · LibVNCServer · opensuse · tumbleweed
- [libvncserver1]Unknown
Source package: [LibVNCServer]
Details (1)
0.9.15-4.1· x86_64 · tumbleweedUnknown · Fixed:
0.9.15-3.1Version impact unknown
nvd · LibVNCServer · opensuse · tumbleweed
- [LibVNCServer-devel]Unknown
Source package: [LibVNCServer]
Details (1)
0.9.15-4.1· x86_64 · tumbleweedUnknown · Fixed:
0.9.15-3.1Version impact unknown
nvd · LibVNCServer · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [libvncclient1]Fixed
Source package: [libvncserver]
Details (2)
0.9.14+dfsg-1+deb12u2· amd64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
0.9.14+dfsg-1+deb12u2· arm64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
- [libvncserver1]Fixed
Source package: [libvncserver]
Details (2)
0.9.14+dfsg-1+deb12u2· amd64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
0.9.14+dfsg-1+deb12u2· arm64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
- [libvncserver-dev]Fixed
Source package: [libvncserver]
Details (2)
0.9.14+dfsg-1+deb12u2· amd64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
0.9.14+dfsg-1+deb12u2· arm64 · bookwormFixed · Fixed:
0.9.14+dfsg-1+deb12u2nvd · libvncserver · debian · bookworm; nvd · libvncserver · debian · 12
[Debian 13 (Trixie)]
- [libvncclient1]Fixed
Source package: [libvncserver]
Details (2)
0.9.15+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
0.9.15+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
- [libvncserver1]Fixed
Source package: [libvncserver]
Details (2)
0.9.15+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
0.9.15+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
- [libvncserver-dev]Fixed
Source package: [libvncserver]
Details (2)
0.9.15+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
0.9.15+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
0.9.15+dfsg-1+deb13u2nvd · libvncserver · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2427-1.json]
- [https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1]
- [https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-44988]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-44988]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22190-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2427-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:2428-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10905-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21118-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-44988]
- [https://ubuntu.com/security/notices/USN-8463-1]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]