PT-2026-27461 · Unknown · Libvncserver

Y637F9Qq2X · Publicado 2026-03-24 · Atualizado 2026-05-09 · CVE-2026-32854

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibVNCServer versions prior to the commit dc78dee LibVNCServer version 0.9.15

Description The software contains null pointer dereference issues in the HTTP proxy handlers within the httpProcessInput() function in httpd.c. These issues allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Specifically, missing validation of the strchr() return values in the CONNECT and GET proxy handling paths can trigger null pointer dereferences, leading to a server crash when httpd and proxy features are enabled.

Recommendations Update LibVNCServer to a version after the commit dc78dee.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-32854

OESA-2026-2252

OESA-2026-2253

OESA-2026-2254

OESA-2026-2255

OPENSUSE-SU-2026:10433-1

OPENSUSE-SU-2026:20552-1

SUSE-SU-2026:1124-1

SUSE-SU-2026:1173-1

SUSE-SU-2026:1174-1

SUSE-SU-2026:21206-1

Produtos afetados

Libvncserver

Referências · 32

• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x · Aviso do Fabricante
• https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 · Correção
• https://osv.dev/vulnerability/OESA-2026-2254 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2252 · Nota
• https://bugzilla.suse.com/1260431 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32854 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2026:1173-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:21206-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-32853 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32854 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2026:1124-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261173-1 · Nota
• https://osv.dev/vulnerability/OESA-2026-2255 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-32854 · Aviso do Fabricante
• https://vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference · Nota