CVE-2026-32854 - Vulnerability Analysis

Overview

LibVNCServer <= 0.9.15 contains a null pointer dereference caused by missing validation of strchr() return values in HTTP proxy handlers in httpd.c, letting remote attackers cause denial of service via crafted HTTP requests, exploit requires httpd and proxy features enabled.

Severity & Score

Impact

Remote attackers can crash the server causing denial of service.

Mitigation

Update to a version including commit dc78dee or later.

References

• https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314
• https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
• https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner