CVE-2018-20748

CRITICAL 9.8CVE-2018-20748 · Published 30/01/2019 · updated 17/06/2026

In short

CVE-2018-20748 is a CRITICAL (CVSS 9.8) vulnerability affecting libvncserver (libvnc project).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.6% of all vulnerabilities.
Fix: update to 0.9.12 or later.

Package	Affected versions	Patched versions
libvncserver libvnc_project	`< 0.9.12`	`0.9.12`

Description

LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.

References

cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf · Patch
LibVNC/libvncserver commit a64c3b3 · Patch
LibVNC/libvncserver commit c2c4b81 · Patch
LibVNC/libvncserver commit c5ba3fe · Patch
LibVNC/libvncserver commit e34bcbb · Patch
LibVNC/libvncserver · Issue Tracking
lists.debian.org/debian-lts-announce/2019/01/msg00029.html · Mailing List
lists.debian.org/debian-lts-announce/2019/10/msg00042.html · Mailing List
usn.ubuntu.com/3877-1 · Third Party Advisory
usn.ubuntu.com/4547-1 · Third Party Advisory
usn.ubuntu.com/4587-1 · Third Party Advisory
openwall.com/lists/oss-security/2018/12/10/8

More vulnerabilities in libvncserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libvncserver

libvnc_project

< 0.9.12

0.9.12

More vulnerabilities in libvncserver

See all →