VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 17, 2020· Updated Aug 5, 2024

CVE-2019-20839

CVE-2019-20839

Description

libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In LibVNCServer before 0.9.13, a buffer overflow in ConnectClientToUnixSock allows attacks via a long socket filename.

Vulnerability

A buffer overflow vulnerability exists in libvncclient/sockets.c in LibVNCServer versions prior to 0.9.13. The function ConnectClientToUnixSock copies a socket filename into a fixed-size buffer (struct sockaddr_un.sun_path) using strcpy without length checking, leading to a stack-based buffer overflow when the filename exceeds the buffer size (typically 108 bytes). [1] [4]

Exploitation

An attacker can exploit this by providing an overly long socket filename to the VNC client, e.g., when connecting to a malicious VNC server that returns a crafted socket address. No authentication is required, but the attacker must control the socket filename passed to the vulnerable function. [1] [4]

Impact

Successful exploitation results in a buffer overflow, potentially causing a crash or arbitrary code execution in the context of the VNC client process. The impact is limited to denial of service or remote code execution depending on exploitability. [1] [4]

Mitigation

The vulnerability is fixed in LibVNCServer version 0.9.13, released in 2020. The fix adds a bounds check that rejects filenames longer than sizeof(addr.sun_path) (commit 3fd0397). Users should upgrade to 0.9.13 or later. No workaround is available. [1] [4]

References
  1. Comparing LibVNCServer-0.9.12...LibVNCServer-0.9.13 · LibVNC/libvncserver
  2. libvncclient: bail out if unix socket name would overflow · LibVNC/libvncserver@3fd0397

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.