VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 19, 2018· Updated Aug 5, 2024

CVE-2018-20020

CVE-2018-20020

Description

LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap out-of-bounds write in LibVNC client code before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d allows remote code execution via crafted VNC server responses.

Vulnerability

The vulnerability is a heap out-of-bounds write in the LibVNC client code, present in LibVNC libraries before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d (which corresponds to version 0.9.12) [1]. The flaw resides in a structure handling VNC client-server communication, triggered when processing specially crafted data from a malicious VNC server.

Exploitation

An attacker must control a VNC server that the victim's VNC client connects to. User interaction is required in the form of initiating the connection (e.g., opening the VNC viewer) [1]. No authentication is needed. The attacker sends malicious data that triggers the out-of-bounds write in the client's heap memory.

Impact

Successful exploitation can lead to remote code execution in the context of the VNC client application [1]. This could allow the attacker to compromise the client system, potentially gaining full control.

Mitigation

The fix was included in LibVNC commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d and the 0.9.12 release [1]. Users should upgrade to LibVNCServer 0.9.12 or later [3]. For Gentoo Linux, the package net-libs/libvncserver should be updated to >=0.9.12 [3]. The ssvnc package, which also uses LibVNC, is discontinued and should be unmerged [2]. No workaround is known.

References
  1. KLCERT-18-030: LibVNC Heap Out-of-Bound Write | Kaspersky ICS CERT EN
  2. Multiple vulnerabilities (GLSA 202006-06) — Gentoo security
  3. Multiple vulnerabilities (GLSA 201908-05) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.