VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 17, 2020· Updated Aug 5, 2024

CVE-2019-20840

CVE-2019-20840

Description

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

LibVNCServer before 0.9.13 crashes due to unaligned memory access in hybiReadAndDecode, allowing denial of service.

Vulnerability

An issue in libvncserver/ws_decode.c in LibVNCServer before version 0.9.13 can cause a crash due to unaligned memory accesses in the hybiReadAndDecode function. The code previously used a uint32_t * pointer to access data that may not be aligned to a 4-byte boundary, leading to a crash on architectures that require aligned access [1][3].

Exploitation

A remote attacker can trigger the vulnerability by sending crafted WebSocket frames to a server using LibVNCServer. No authentication or special privileges are required. The unaligned access occurs during the decoding of masked WebSocket frames, causing the server to crash [2][3].

Impact

Successful exploitation results in a denial of service (DoS) because the server process crashes. The vulnerability does not lead to code execution or information disclosure [2].

Mitigation

The vulnerability is fixed in LibVNCServer version 0.9.13 [1]. Ubuntu has released security updates for affected versions (16.04 LTS and 18.04 LTS) [2]. No workaround is available if the software cannot be updated.

References
  1. Comparing LibVNCServer-0.9.12...LibVNCServer-0.9.13 · LibVNC/libvncserver
  2. USN-4434-1: LibVNCServer vulnerabilities | Ubuntu security notices | Ubuntu
  3. fix crash because of unaligned accesses in hybiReadAndDecode() · LibVNC/libvncserver@0cf1400

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

26

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.