VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 19, 2018· Updated Aug 5, 2024

CVE-2018-20024

CVE-2018-20024

Description

LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

LibVNC <= 0.9.11 contains a null pointer dereference in client code leading to denial of service via a crafted server message.

Vulnerability

LibVNCServer before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 (versions prior to 0.9.12) contains a null pointer dereference in the VNC client code [1][3]. This vulnerability can be triggered when a VNC client connects to a malicious VNC server that sends specially crafted data, causing a null pointer to be dereferenced and resulting in a denial-of-service condition.

Exploitation

An attacker must set up a malicious VNC server and convince a user to connect to it (user interaction is required). Once the client connects, the server sends crafted messages that trigger the null pointer dereference in the client code, leading to a crash of the client application.

Impact

Successful exploitation results in a denial of service (DoS) against the VNC client application. No remote code execution or data compromise has been reported.

Mitigation

The fix was committed in October 2018 and included in LibVNCServer version 0.9.12 [1][3]. Users should upgrade to LibVNCServer 0.9.12 or later. Gentoo has released GLSA 201908-05 recommending the upgrade [3]. For the ssvnc package, which bundles LibVNC, Gentoo has discontinued support and recommends removal (GLSA 202006-06) [2]. No workaround is available.

References
  1. KLCERT-18-034: LibVNC NULL Pointer Dereference | Kaspersky ICS CERT EN
  2. Multiple vulnerabilities (GLSA 202006-06) — Gentoo security
  3. Multiple vulnerabilities (GLSA 201908-05) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.