VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 17, 2020· Updated Aug 4, 2024

CVE-2020-14402

CVE-2020-14402

Description

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

LibVNCServer before 0.9.13 has an out-of-bounds access in corre.c via encodings, potentially causing info disclosure or DoS.

Vulnerability

An out-of-bounds access vulnerability exists in LibVNCServer versions before 0.9.13. The issue resides in libvncserver/corre.c and can be triggered via crafted encodings, allowing an attacker to read or write beyond allocated memory buffers. [2]

Exploitation

An attacker can send specially crafted encoding data to a LibVNCServer instance. No authentication is required if the VNC server is exposed. The attacker only needs network connectivity to the server to trigger the out-of-bounds access.

Impact

Successful exploitation could lead to information disclosure (reading sensitive memory) or denial of service (crash). Arbitrary code execution may be possible in some contexts, though not confirmed in available references.

Mitigation

The vulnerability is fixed in LibVNCServer version 0.9.13. Users should upgrade to the latest version. For Ubuntu systems, security updates were released (e.g., USN-4434-1). If upgrading is not possible, consider restricting network access to the VNC server. [2]

References
  1. USN-4434-1: LibVNCServer vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.