VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 23, 2020· Updated Aug 5, 2024

CVE-2019-20788

CVE-2019-20788

Description

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in LibVNCClient's HandleCursorShape function allows a malicious VNC server to trigger a heap buffer overflow, potentially leading to RCE.

Vulnerability

LibVNCServer through version 0.9.12 contains an integer overflow vulnerability in the HandleCursorShape function in libvncclient/cursor.c. When a client connects to a VNC server, the server can send a cursor shape update with a large width or height value. The calculation bytesPerRow = (width + 7) / 8 and bytesMaskData = bytesPerRow * height can overflow, leading to an undersized heap allocation. The subsequent malloc(width * height * bytesPerPixel) [1] also relies on the unchecked dimensions. The issue was fixed in LibVNCServer 0.9.13 [1] and in commit 5422024 [3], which introduced a MAX_CURSOR_SIZE check (set to 1024) to reject cursors with dimensions equal to or greater than that limit [3].

Exploitation

An attacker who controls a malicious VNC server can exploit this vulnerability when a vulnerable client connects and processes a crafted cursor shape update. No authentication is required; the attacker simply sends a specially crafted RFB message with oversized width or height fields. The vulnerable client will then compute a buffer size that may overflow or be far smaller than expected, leading to a heap buffer overflow when copying pixel data into the allocated buffer [1].

Impact

Successful exploitation allows the attacker to corrupt heap memory, potentially leading to remote code execution (RCE) in the context of the VNC client process. The vulnerability can also cause a denial of service via crash. The scope of compromise is limited to the client machine, but an attacker may achieve arbitrary code execution [1].

Mitigation

The vulnerability was addressed in LibVNCServer version 0.9.13, released on April 23, 2020 [1]. Users should upgrade to this version or later. The fix is also included in the commit 5422024 [3], which enforces a maximum cursor size of 1024 pixels. Users of Linux distributions should apply the relevant security updates (e.g., USN-4407-1 [2]). There is no known workaround other than updating, and the vulnerability is not listed in CISA's KEV.

References
  1. GHSL-2020-064: integer overflow in LibVNCClient HandleCursorShape resulting in remote heap overflow - CVE-2019-20788
  2. USN-4407-1: LibVNCServer vulnerabilities | Ubuntu security notices | Ubuntu
  3. libvncclient/cursor: limit width/height input values · LibVNC/libvncserver@5422024

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

1
54220248886b

libvncclient/cursor: limit width/height input values

https://github.com/LibVNC/libvncserverChristian BeierNov 17, 2019via osv
commit
1 file changed · +5 −0
  • libvncclient/cursor.c+5 −0 modified
    @@ -28,6 +28,8 @@
 #define OPER_SAVE     0
 #define OPER_RESTORE  1
 
+#define MAX_CURSOR_SIZE 1024
+
 #define RGB24_TO_PIXEL(bpp,r,g,b)                                       \
    ((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255             \
     << client->format.redShift |                                              \
@@ -54,6 +56,9 @@ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h
   if (width * height == 0)
     return TRUE;
 
+  if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)
+    return FALSE;
+
   /* Allocate memory for pixel data and temporary mask data. */
   if(client->rcSource)
     free(client->rcSource);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.