Dashboard / CVE-2026-32854

CVE-2026-32854

MEDIUM
MEDIUM Priority: 0.35 BB Relevance: 74/100
Published: 2026-03-24 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: None
VI: None
VA: Low

Description

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
LibVNC LibVNCServer 0

References & Advisories (3)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

5.53%
Raw Score 0.055330
Percentile 92.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.05533
2026-11-12
0.05533
2026-11-10
0.05533
2026-11-09
0.05415
2026-11-08
0.05415

Intelligence Sources

mitre ref →

External Links