VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 19, 2018· Updated Aug 5, 2024

CVE-2018-20019

CVE-2018-20019

Description

LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

LibVNC client code before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write flaws that can lead to remote code execution.

Vulnerability

LibVNC (LibVNCServer/LibVNCClient) prior to commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f (corresponding to version 0.9.12) contains multiple heap-based out-of-bounds write vulnerabilities in the VNC client code. An affected application using the library as a VNC client can be exploited when connecting to a malicious server [1][2].

Exploitation

No authentication is required for the attacker; they need only run a malicious VNC server that sends crafted data to the connecting client. The client must initiate a connection to the attacker-controlled server, requiring user interaction (e.g., clicking a link or opening a VNC session) [1]. The heap out-of-bounds writes are triggered during parsing of server responses [1].

Impact

Successful exploitation allows the attacker to achieve remote code execution within the context of the affected application (e.g., a VNC client), potentially leading to full system compromise [1][2].

Mitigation

LibVNC fixed these vulnerabilities in commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f and version 0.9.12 (released September 2018). Users should upgrade to version 0.9.12 or later. There is no known workaround [1][2].

References
  1. KLCERT-18-029: LibVNC Multiple Heap Out-of-Bound Vulnerabilities | Kaspersky ICS CERT EN
  2. Multiple vulnerabilities (GLSA 201908-05) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.