CVE-2026-44988

{
  "id": "CVE-2026-44988",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T15:16:29.830",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1."
    },
    {
      "lang": "es",
      "value": "LibVNCClient es una biblioteca para la fácil implementación de un cliente VNC. En 0.9.15 y versiones anteriores, el decodificador de codificación Tight de LibVNCClient utiliza búferes temporales de tamaño fijo de 2048 píxeles para el filtro Gradient, pero no rechaza los rectángulos Tight cuyo ancho es mayor de 2048 píxeles. Un servidor VNC malicioso puede enviar un rectángulo FramebufferUpdate manipulado utilizando codificación Tight con NoZlib | ExplicitFilter y el filtro Gradient. Cuando un cliente basado en LibVNCClient se conecta, el cliente procesa el ancho del rectángulo controlado por el servidor y escribe más allá de los búferes Gradient de tamaño fijo. Esta vulnerabilidad se corrige con el commit 5b270544b85233668b98161323297d418a8f5fd1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "LibVNC",
          "product": "libvncserver",
          "versions": [
            {
              "version": "<= 0.9.15",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-29T03:55:55.774539Z",
          "id": "CVE-2026-44988",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58",
      "source": "[email protected]"
    }
  ]
}