CVE Feed

    Dashboard / CVE / CVE-2016-9942

    CVE-2016-9942

    Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.

    Published:Nov 14, 2016
    Last Modified:Apr 12, 2025
    EPS:Dec 31, 2016
    EPSS Score:0.00836
    CVSS Score:9.8

    Affected Products

    Vendor
    Libvncserver Project
    Product
    Libvncserver

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-32854 (CVSS 6.3) — LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilit…
    CVE-2026-32853 (CVSS 6.9) — LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerabili…
    CVE-2020-29260 (CVSS 7.5) — libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().…
    CVE-2020-14400 (CVSS 7.5) — An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers…
    CVE-2020-14401 (CVSS 6.5) — An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow…
    CVE-2020-14399 (CVSS 7.5) — An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers…
    CVE-2020-25708 (CVSS 7.5) — A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to se…
    CVE-2018-7225 (CVSS 9.8) — An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does no…
    CVE-2017-18922 (CVSS 9.8) — It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket …
    CVE-2016-9941 (CVSS 9.8) — Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High